|
Domanda |
Risposta |
|
inizia ad imparare
|
|
system(); StartProcess(); java. lang. Runtime exec()
|
|
|
|
inizia ad imparare
|
|
via URL hhtps://... COLOR=http://evil...
|
|
|
|
inizia ad imparare
|
|
' or 1=1 --; xp_cmdshell; exec master
|
|
|
|
inizia ad imparare
|
|
%27 '; %3D =; union keyword
|
|
|
|
inizia ad imparare
|
|
html tags, <script><IMG><INPUT>
|
|
|
|
inizia ad imparare
|
|
|
|
|
|
inizia ad imparare
|
|
|
|
|
XSS ways to attack/manipulate/bypass inizia ad imparare
|
|
hex encoding, toggle case <SCRIPT>, double encoding, replaced keywords, whitespace manipulation
|
|
|
|
inizia ad imparare
|
|
netstat -ab; many TIME_WAIT sent by single IP
|
|
|
|
inizia ad imparare
|
|
limit length of input, hex encoding, custom error messages, disable XP_CMDSHELL, monitor traffic
|
|
|
Eradicating File Injection inizia ad imparare
|
|
chroot jail, disable allow_url_open/include
|
|
|
Eradicating Command Injection inizia ad imparare
|
|
input validation, safe API, input/output encoding
|
|
|
Eradaicating LDAP Injection inizia ad imparare
|
|
LDAP filters, domain value validation, access control tight, dynamic testing and source code analysis
|
|
|
Eradicating: Broken authentication (1) inizia ad imparare
|
|
use SSL, use MFA, no IDs in URL, password policy
|
|
|
Eradicating: Sensitive data exposure (2) inizia ad imparare
|
|
data is encrypted, dont create or use weak algorithms, no caching for data that is sensitive, secure protocols
|
|
|
Eradicating: XML external entity attacks (3) inizia ad imparare
|
|
no weakly configure XML parsers, XML unmarshaller, no DOC TYPE tag, input validation, avoid simple forms like JSON
|
|
|
Eradicating: Broken Access Control (4) inizia ad imparare
|
|
check before redirect, limit file permissions, avoid client-side caching mechanisms, remove login tokens when logout
|
|
|
Eradicating: Security missconfigurations attacks (5) inizia ad imparare
|
|
disable unused services, default accounts change/disable, use SSL, secure flag on sensitive cookiies, valid certificates
|
|
|
Eradicating: Insecure deserialization (7) inizia ad imparare
|
|
validate input, avoid serialization, filter usntrased data
|
|
|
Eradicating: XSS attacks (6) inizia ad imparare
|
|
rigorus validation of input, use testing tool during design, WAF to block malicious scripts, use HTML encoding, filter Meta characters, deplot PKI (PUBLIC)
|
|
|
Eradicating: due to Known Vulnerabilities (8) inizia ad imparare
|
|
updates, monitor vulnerabilities, patch regulary, scan with security scanners, enforce best prtactices
|
|
|
Eradaicating: Insufficient logging and monitoring inizia ad imparare
|
|
define scope of assets, minimum baseline for logging, proactive approach, prevent log injection attacks by sanitization, logs with user context
|
|
|
Eradicating: DoS attacks (10) inizia ad imparare
|
|
deny external ICMP, limit length of input, block inbound traffic transmitted through service ports
|
|
|
