Investigating Web Attacks Flashcards
Web Forensic Challenges
- Web applications are generally distributed in nature
- Traces of activities are recorded across a number of hardware and software infrastructures
- Very limited or no downtime is allowed for investigation
- Huge volume of logs from different sources are analyzed and correlated
- Large databases are analyzed
- Requires complete knowledge of different web servers, application servers, databases and underlying applications
- Tracing back is difficult in case of reverse proxies and anonymizers
OWASP Web vulnerability Top 10:
The OWASP Top 10 is an awareness document for web application security. It represents a broad consensus about the most critical security risks to web applications. Project members include a variety of security experts from around the world who have shared their expertise to produce this list. https://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project
Buffer Overflow
Occurs when an application fails to guard its buffer properly and allows writing beyond its maximum size. As a result, it overwrites the adjacent memory locations. There are multiple forms of buffer overflow, including a Heap Buffer Overflow and a Format String Attack. The purpose of these attacks is to corrupt the execution stack of the web application.
Cookie Poisoning
Refers to the modification of a cookie for bypassing security measures or gaining unauthorized information.
Insecure Storage
Sensitive information such as account records, credit card numbers, or passwords are generally stored in a database. If the developers make any mistakes while enforcing the encryption techniques on a web application or ignore the security aspects of some parts of the application, this sensitive information might be at risk. You should understand the processes used to store the data.
Information Leakage
Information leakage refers to the unintentional revelation of sensitive information to an unauthorized user.
Improper Error Handling
When a web application is unable to handle internal errors properly. In such case, the website returns information, such as database dumps, stack traces, and error codes in the form of errors.
Broken Account Management
Refers to vulnerable account management functions including account update, recovery of the forgotten or lost password or resetting the password.
Directory Traversal
When attackers exploit HTTP by using directory traversal, they gain access to the unauthorized directories. Then, the attackers may execute commands outside the web server’s root directory.
Parameter/Form Tampering
Manipulating the communication parameters exchanged between the client and server to make changes in the application data. A Man in the Middle (MitM) is one of the examples of this type of attack.
Denial of Service (DoS)
Making the resources of the web server unavailable to clients.
Log Tampering
Web applications maintain logs to track the usage patterns, such as admin login credentials and user login credentials. The attackers usually inject, delete or tamper the web application logs to engage in malicious activities or hide their identities.
Unvalidated Input
In order to bypass the security system, the attackers tamper with the URL, HTTP requests, headers, hidden fields, form fields, query strings, etc. User login IDs and other related data get stored in the cookies and this becomes a source of attack. Examples of attacks that caused un validated input include SQL injection, cross-site scripting (XSS), buffer overflows, etc.
Injection Flaws
Attackers inject malicious code, commands or scripts into the input gates of flawed web applications in such a way that the applications interpret and run the malicious input, which in turn allows them to extract sensitive information.
Cross Site Request Forgery (CSRF)
Forces a logged-on victim’s browser to send a forged HTTP request, including the victim’s session cookie and any other automatically included authentication information, to a vulnerable web application. This allows the attacker to force the victim’s browser to generate requests the vulnerable application thinks are legitimate requests from the victim.
Broken Access Control
An attacker identifies a flaw related to access control and bypasses the authentication, and then compromises the network.
Insecure Direct Object References
When developers expose various internal implementation objects such as files, directories, or database records, it can result in a direct object reference that provides an attacker the ability to gain unauthorized access to system resources.
Insecure Direct Object References
When developers expose various internal implementation objects such as files, directories, or database records, it can result in a direct object reference that provides an attacker the ability to gain unauthorized access to system resources.
SSL/TLS Downgrade Attack
Browsers are susceptible to protocol downgrade attacks; an active MITM can simulate failure conditions and force all browsers to downgrade from attempting to negotiate TLS 1.2, making them fall back to SSL 3. At that point, a cryptographic attack could be successfully attempted, such as the POODLE attack.
Failure to Restrict URL Access
An attacker tries to bypass the website security using techniques, such as forced browsing, and gains unauthorized access to specific web pages or other data files containing sensitive information.
Cookie Snooping
An attacker using a local proxy decodes or cracks user credentials. Once the attacker gains these plain text credentials, he/she logs into the system as a legitimate user and gains access to unauthorized information.
Authentication Hijacking
Attackers try to hijack credentials using various attack techniques like sniffing, social engineering, etc. Once they obtain these credentials, they carry out malicious acts, including session hijacking, service theft, and user impersonation.
Hidden Field Manipulation
attackers manipulate hidden fields and change the data stored in them. This sort of attack is focused on e-commerce sites.
Unvalidated Redirects and Forwards
Attackers lure the victim and make them click on unvalidated links that appear to be legitimate. Such redirects may lead to the installation of malware or trick the victims into sharing their passwords or other sensitive information.
