Data and functions not properly protected against adversarial access, leading unauthorized access. Such as:

#1 Just hiding “unauthorized” objects in Presentation-layer

#2 Access controls not enforced over *all* URLs to deny unauthorized file access

#3 Direct Object Access to other profiles via parameter ?id=123

#4 Directory traversal using ../../../etc/file as file’s name in URL

#3 Eliminate direct reference using temporary mapping value such as id=123 -> id=7d3JU0$&8=*(B

#4 Validate all references, forbid directory traversal attempts, use file permission in the server

#2 Local File inclusion (LFI), (include($_GET[“input”])), hack with Directory traversal.

#3 Improper validation of parameters, fail to validate parameters sent to functions.

<!DOCTYPE pass [
<ENTITY LocalFile "c:\file.txt">
<ENTITY RemoteFile "http://hack.com/file">
<!ENTITY XXE SYSTEM "http://192.168.1.1/private">
]>

#1 Command Injection, codes are dropped into shell and execute as the OS-site CMDs, such as PHP system(), Python os.system()

#2 Code Injection, data as code to inject (can concatenate with other parameters) into program itself by breaking syntax using some separators from the syntax of the language. Such as the program is using eval('input')…

MySQL IF, LIKE 'a%' and REGEXP '^a', sleep(5), count(*) are using in such as:

AND IF (password LIKE BINARY 'p%', sleep(5), null), to detect if password start with ‘p’, then wait 5 seconds.

AND password REGEXP '^[a-b]' AND SLEEP(5), True if start with a or b or c or d then sleep 5s.

AND IF((SELECT COUNT(*) FROM information_schema.columns WHERE table_name = 'users') LIKE 5, sleep(5), null), if # of row return is 5, sleep for 5s, else do nothing.

NoSQL this.match(/^[A-Za-z0-9]$/)

#1 Credential spraying attacks, hacker use a list of passwords to guess a user current password

#2 Credential stuffing attacks, hacker compromise a site, then use the same credential to test on other sites.

#3 Credential harvesting attacks, hacker can collect user reused credential in a Phishing site that providing simple services.

– Using strong password, not common/reused password.

– Multi-factor authentication (2FA) using: cellphone, Yubikey, FIDO, …

#1 Guessable default credentials, user using default, or custom but easy-to-guess password.

#2 Vulnerable account/password recovery, using Guessable password reset questions, reset links, or the reset links is not secure.

#3 Vulnerable authentication processes, no limits on authentication attempts and failures, CAPTCHA authentication issues,  Side-channel attacks (Program #2), Case-sensitivity issues.

#4 Password storage problems, password store in clear format instead of hashed, or in insufficient cryptographic levels.

#5 Vulnerable session IDs, cookies, tokens, credentials, and keys, such as:
– Session IDs carried in URLs
– Tokens sent in cookies over HTTP (not https)
– Session tokens not bound to an IP
– Tokens containing semantic values or use predictable value
– Insecure management of session information at server

#4 Employ hash stretching and slow password hashing algorithms. Password: iterations:salt:hash
– Password stored using hashes, and with “salt” (a random data hashed with password).
– Iterate a salt through a password hash algorithm multiple times, like 10000 times to slow the brute-force.

#5 Use session management by framework, Timeout sessions, session information transmitted via Https, Random encrypt and digitally sign the session token.

An App using unvalidated redirect: header("Location: " . $_GET['url']);

An web app allow to forward unvalidated requests to a different parts of the site (administrative site), but without checking that user is authorized to access the URL (Broken Access control).

– Authorize via access controller before forwarding (only authorized user who are permitted to access).

<script src="https://gmail.com/p?jsonp=leak"></script>

Hacked on including user JSON file since  JSON inclusion automatically calls Array constructor, then execute code to steal user other site’s info

<script src="https://bank.com/user?key=leak"></script>

Attaching a random per-user token to all JSON URLs that retrieving sensitive data

Using Cross-origin resource sharing (CORS) header

Hacker trick user to access his rogue site where he can then access the vulnerable site on behalf of user (assume user has login to the vulnerable site), in a way of trap, e-mail, etc.

<img src=https://www.bankpal.com/transfer_funds?amount=1000&to_account=13273/>

Or submit form automatically:

<form name="csrfForm" action="http://www.secureBank.ie/sendMoney" method="POST">
<input type="hidden" name="giveMoneyTo" value="hacker" />
</form>
<script>document.csrfForm.submit();</script>

Set-Cookie: first_party_var=value; SameSite=Strict cookies only shared within the same domain

SameSite=Lax  cookie included only if done via HTTP GET

SameSite=None; Secure Allow all cross-domain usage of cookies

<input name="token" value="687965fdfaew87agrde" type="hidden"> tokens is crytographically secure (random hash), unique for each function

DENY SAMEORIGIN ALLOW-FROM http://site.com

Serer sends serialized objects to client, then client update and regenerate the original object and send back to server, then server deserializing the untrusted data from client, which can lead to code injection and remote code execution on server.

Malicious code executed upon deserialization.

serialize(new Object(”))

unserialize(serialized_obj_string)

Override default methods to ensure safe deserialization, only deserialize data user is supposed to modify, control what classes can be instantiated

syslog (unix OS log)

wtmp, utmp, btmp (log events)

access_log (web server)

windows security access logs

Not properly reducing privileges of services

Misconfigure frameworks (disable eval(), hide errors, safe_mode, limit file upload, POST size)

Not removing credential in source code

Not enabling HSTS (Http strict transport security)

Vulnerability scanning CVEs (automated vulnerability management, policy compliance for OS)

Fixing security issues and bugs as early in development cycle as possible

Attach the update process

Insecure handing such as just check if the URL including the required domain’s name.