Common Attacks

Name: Common Attacks
Author: Jay Shafftstall

In this module you’ll learn about some common vulnerabilities and how to protect your web app against them.

Preview the first lesson free — get full access to all 10 lessons.

Course: On-Demand

In this chapter, we're going to look at some common attacks, and how the sample bulletin board site is vulnerable, and how to fix it for those attacks. The first vulnerability we'll look at is cross-site scripting. Remember that cross-site scripting is a vulnerability that happens when we take input from one user and display it to another user. Why is this a vulnerability? Remember that what the server sends to the user is displayed as an HTML page. HTML page can include JavaScript which is code that executes on the browser. We don't want hackers to put code on our site that executes in other users browsers. The bulletin board site has two places where we take input from one user and display it to other users. One is in the user profiles, and the other is in bulletin board posts. We're gonna look specifically at user profiles. So here, when we have recent posts, we can click on a user's profile, on user's name to see their profile. And there we see the profile for John. Now, if John wants to edit their profile, I'm currently logged in as John, I can click on Edit Profile. And then they can change their About text and change their profile pic. To test to see if a particular field is vulnerable to cross-site scripting, we just have to enter in some HTML into it. So for example, let's make this last bit bold, if we're vulnerable to cross-site scripting. If we're not vulnerable to cross-site scripting, then we'll see the actual tag, strong. We'll go back, and we'll view John's profile. So we can see that that sentence is actually bold. We don't see the tags. The tags are being interpreted as HTML. That means that this particular field is vulnerable to cross-site scripting. Let's look at another example. Remember that HTML can include JavaScript. Since it's vulnerable to cross-site scripting, this script will execute when a user views John's profile. So that script executed and displayed an alert. Now an alert is fairly benign, but any JavaScript could have been in there, and it would have been executed. So cross-site scripting allows hackers to put code into your site that will execute on other users browsers. How do we fix that? Well, the basic idea is that we have to process the output and replace certain key characters with HTML equivalents. For example, we replace the less than sign with an &lt;. We replace the greater than sign with a similar HTML entity. Now we have to do that with every single character that is special to HTML. This has to be done with any output that we send to the user's browser that includes other user's input. And it's really easy to miss places. So the best way of solving this is to use a templating system. Templating system is basically a mini-language that we use to build our webpages in. Let me show you the templating system that this particular site is using. So we're using the Twig templating system. You can see that, for example, we have a heading there that says Profile for, and then in double curly braces, it's person.name. That's taking the contents of a variable called person, taking a field in it called name, and then outputting it to the web browser. Templating systems by default will protect you from cross-site scripting. In fact, I had to specifically tell this templating system to not protect me so that we could see the vulnerability. We look down where we output the About text. I added in the raw flag there to tell the templating system, don't protect me from cross-site scripting. So let me remove that raw flag, save that and then refresh this profile. So now you can see that I see the actual JavaScript that they entered in. It does not execute. A templating system is by far your best way to protect against cross-site scripting, since it will automatically protect you on every single time that you output something to the web browser. You don't have to worry about missing something in your filter. There is another cross-site scripting vulnerability in the bulletin board site. Remember what we talked about when we talked about input and output and what actions might be vulnerable. I'll leave it as an exercise for you to find that one and fix it. Thanks for watching. In the next lesson, we'll look at URL manipulation, very common trick trick hackers use to get access to areas they shouldn't be able to access.

Beginner Provider : Jay Shafftstall 10 Lessons · 27m in Arabic, German, English, Spanish, French, Portuguese, Chinese

Course Description

In this module you’ll learn about some common vulnerabilities and how to protect your web app against them.

What You'll Learn

Understand cross-site scripting and how it threatens web applications
Identify URL manipulation attacks and the dangers of putting filenames into URLs
Recognize remote code execution and file upload abuse risks
Defend against denial-of-service attacks
Examine session-based attacks including session hijacking, session fixation, and cross-site request forgery
Apply session protections such as expiring sessions

Key Takeaways

The module covers common web application vulnerabilities and how to protect a web app against them.
Cross-site scripting, URL manipulation, remote code execution, and denial-of-service are among the common attacks addressed.
Putting filenames into URLs introduces dangers the course explains alongside filename vulnerabilities and file upload abuse.
Session-related threats covered include session hijacking, cross-site request forgery, and session fixation, with expiring sessions as a protective measure.
The course develops skills in application security, attack patterns, vulnerability scanning and management, and web application security.

Frequently Asked Questions

What does this course cover?

This module covers common web application vulnerabilities and how to protect your web app against them, including cross-site scripting, URL manipulation, the dangers of putting filenames into URLs, remote code execution, and denial-of-service attacks.

What topics are included in the lessons?

Lessons include Common Attacks, URL Manipulation, Filename Vulnerabilities, Remote Code Execution, File Upload Abuse, Denial of Service, Session Hijacking, Cross Site Request Forgery, Session Fixation, and Expiring Sessions.

What skills will I gain from this course?

You will build skills in application security, attack patterns, vulnerability scanning, vulnerability management, the Web Application Attack and Audit Framework (W3AF), and web application security.

Does the course address session-related attacks?

Yes. The course includes lessons on session hijacking, cross site request forgery, session fixation, and expiring sessions.