Web-applications-attacks

Description

This article deals with common web attacks and aims at making people aware of these attacks in order that they better code their applications. Each of these attacks is going to be explained, theoretically and practically and a way to patch your applications is also given.

Attacks

Attacks based on directories Path disclosure Directory traversal Directory listening Predictable files and directories .htaccess vulnerabilities Injections & inclusions Cross Site Scripting (XSS) Cross Site Request Forgery (CSRF or XSRF) Cross Site Tracing (XST) Local File Inclusion (LFI) Remote File Inclusion (RFI) SQL Injection Command Injection Server Side Includes (SSI)

Information exposure HTML comments inspection Display errors Exceptions exploitation Configuration weaknesses Authentication, sessions & cookies .htaccess vulnerabilities Authentication brute-force Predictable sessions & session hijacking Weak encryption Cookie injection / cookie poisoning

Data verification & purification Client-Side vs server-side verifications Client Side data Data purification HTTP splitting Sniffing Intercept data over the network Buffer overflow & Denial of service (DoS) Buffer overflow Denial of Service (DoS) Concurrency

Recommended readings

• OWASP Top 10 Application Security Risks
• CWE/SANS TOP 25 Most Dangerous Software Errors
• STRIDE and DREAD