3.4 Attacks & exploits: Application vulnerabilities Flashcards
What is Server-Side Request Forgery (SSRF)?
▪ A type of attack that takes advantage of the trust relationship between the server and the other resources it can access
▪ Occurs when a web app fetches a remote resource without validating the URL
How to prevent from a Server-Side Request Forgery (SSRF) (3)?
● Segment remote resource access functionality into separate networks
● Enforce a deny by default firewall or ACL policy
● Ensure web apps sanitize and validate any client-supplied input data
Race Conditions: what is it and explain how it technically occurs?
▪ Occurs when the resulting outcome from execution processes is directly dependent on the order and timing of certain events, which then failed to execute in the order and timing intended by the developer
▪ Occurs when a computer tries to race itself in the processing of certain data
▪ Found where multiple threads attempt to write to a variable or object at the same memory location
▪ Race conditions often happen outside the normally logged processes in a system
Race Conditions: what is Dereferencing?
Occurs when the code attempts to remove the relationship between a pointer and the thing it points to
Race Conditions: what is TOCTOU?
Occurs when there is a change between when an app checks a resource and when the app uses the resource
Race Conditions: what is Mutually Exclusive Flag (Mutex)?
Acts as a gatekeeper to a section of code so that only one thread can be processed at a time
Race Conditions: what is Deadlock?
Occurs when a lock cannot be removed from the resource
Race Conditions: how to prevent from mutexes and locks?
Properly design and test any locks or mutexes
Buffer Overflows: what is it?
▪ Occurs when a process stores data outside the memory range allocated by the developer
▪ Over 85% of data breaches were caused by a buffer overflow
Buffer Overflows: what is a Buffer?
A temporary storage area that a program uses to store data
Buffer Overflows: what is a stack?
Reserved area of memory where the program saves the return address when a function call instruction is received
Buffer Overflows: what “Smashing the Stack” means?
Occurs when an attacker fills up the buffer with NOP instructions
Buffer Overflows: what is Non-Operation (NOP) Instruction?
Tells the system to do nothing and simply go to the next instruction
Buffer Overflows: how to prevent from overflows attacks (4)?
▪ Maintain a good patch management program
▪ Always use secure coding practices: Boundary checking & Input validation
▪ Use Address Space Layout Randomization (ASLR): Prevents an attacker’s ability to guess where the return pointer for a non-malicious program has been set to call back to
▪ Use Data Execution Protection (DEP): Blocks applications that attempt to run from protected memory locations so executable code stored in the user data location will be marked as non-executable
Buffer Overflows: what is an Integer Overflow and what are its consequences?
▪ Occurs when a computed result from an operation is too large to fit into its assigned variable type for storage
▪ Integer overflows and buffer overflows can lead to arbitrary code execution, and in turn, privilege escalations
Authentication and References: what is Broken Authentication in OWASP?
Insecure authentication mechanisms that can allow an attacker to gain entry
Authentication and References: how to prevent from Broken Authentication attacks (7)?
▪ Utilize multi-factor authentication
▪ Never use default credentials
▪ Verify passwords are strong and not found on published password exploitation lists
▪ Use limits or delays to slow failed login attempts and brute force attempts
▪ Use server-side session management and long and randomized session identifiers
▪ Never pass a session identifier as a URL parameter
▪ Implement session timeouts and expiring session identifications
Authentication and References: what is Insecure Direct Object Reference?
Used to manipulate URLs to gain access to a resource without requiring proper authentication
Authentication and References: how to prevent from Insecure Direct Object Reference (2)?
● Always use secure coding practices
● Always implement proper access control techniques to verify a user’s authorization
Improper Headers: what HTTP Response Headers are used for and from what attacks are they helping to protect (6)?
Used to control how web servers operate to increase security during operations. It protects against:
● Cross site request forgery
● Cross site scripting
● Downgrade attack
● Cookie hijacking
● User impersonation
● Clickjacking
