Web Security & OWASP Top 10.

The OWASP Top 10 is a standard awareness document that represents a broad consensus about the most critical security risks to web applications. Published by the Open Web Application Security Project (OWASP), it's updated every few years to reflect the current threat landscape.

The importance lies in:

• Industry Standard: Widely recognized benchmark for application security
• Risk Prioritization: Helps organizations focus on the most critical threats
• Developer Education: Provides guidance for secure coding practices
• Compliance: Many security frameworks reference OWASP Top 10
• Cost-Effective Security: Addresses the most common vulnerabilities that cause the majority of breaches

The current OWASP Top 10 (2021) includes risks like Broken Access Control, Cryptographic Failures, Injection, and others.

Broken Access Control occurs when restrictions on authenticated users are not properly enforced, allowing them to access unauthorized functionality or data.

Common scenarios:

• Vertical privilege escalation: Regular user accessing admin functions
• Horizontal privilege escalation: User accessing another user's data
• Missing authorization checks: Direct object references without validation

Example:

// Vulnerable URL
GET /api/user/123/profile

// Attacker changes user ID
GET /api/user/456/profile  // Accesses another user's profile

Prevention:

• Implement proper authorization checks
• Use deny-by-default principle
• Validate user permissions on every request
• Use role-based access control (RBAC)
• Log access control failures

Input validation is the process of verifying that user-supplied data meets expected criteria before processing it. It's crucial because unvalidated input is the root cause of many security vulnerabilities including injection attacks, buffer overflows, and data corruption.

Key principles:

• Whitelist validation: Define what is acceptable rather than what isn't
• Server-side validation: Never rely solely on client-side validation
• Sanitization: Clean or encode input when validation isn't sufficient
• Length limits: Prevent buffer overflows and DoS attacks

Example of proper validation:

import re

def validate_email(email):
    pattern = r'^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$'
    if re.match(pattern, email) and len(email) <= 254:
        return True
    return False

SQL injection occurs when user input is directly concatenated into SQL queries, allowing attackers to manipulate the database.

Example of vulnerable code:

# VULNERABLE
query = f"SELECT * FROM users WHERE username = '{username}'"

Attack example: username = "admin'; DROP TABLE users; --"

Prevention methods:

1. Parameterized queries/Prepared statements (most effective)
2. Stored procedures (when properly implemented)
3. Input validation (whitelist approach)
4. Least privilege principle for database accounts
5. Web Application Firewalls (additional layer)

Secure example:

# SECURE - Using parameterized query
cursor.execute("SELECT * FROM users WHERE username = %s", (username,))

Cross-Site Scripting (XSS) allows attackers to inject malicious scripts into web pages viewed by other users.

Three main types:

1. Stored XSS (Persistent): Malicious script stored on server

   • Example: Comment section storing <script>alert('XSS')</script>

2. Reflected XSS (Non-persistent): Script reflected from request

   • Example: Search parameter displayed without encoding

3. DOM-based XSS: Vulnerability in client-side JavaScript

   • Example: document.write(location.hash.substring(1))

Impact: Session hijacking, credential theft, defacement, malware distribution

Prevention: Input validation, output encoding, Content Security Policy (CSP), sanitization

Application Security Testing is the process of identifying, analyzing, and reporting security vulnerabilities in software applications. It involves testing applications to find security flaws that could be exploited by attackers to gain unauthorized access, steal data, or disrupt services.

Importance:

• Data Protection: Prevents unauthorized access to sensitive information
• Compliance: Meets regulatory requirements (PCI DSS, HIPAA, GDPR)
• Business Continuity: Reduces risk of security breaches that can cause downtime
• Reputation Management: Protects brand reputation from security incidents
• Cost Reduction: Early detection is cheaper than post-deployment fixes

SAST (Static Application Security Testing):

• Tests source code without executing the application
• Performed early in development lifecycle
• Analyzes code for vulnerabilities like SQL injection, XSS patterns
• Provides detailed location of vulnerabilities in code
• Can produce false positives

DAST (Dynamic Application Security Testing):

• Tests running applications from the outside
• Simulates real-world attacks
• Tests the application as a "black box"
• Finds runtime vulnerabilities and configuration issues
• Lower false positive rate but may miss some code-level issues

Example: SAST might find a potential SQL injection in code like "SELECT * FROM users WHERE id = " + userId, while DAST would test by sending malicious payloads to running endpoints.

Penetration Testing:

• Simulates real attacks to exploit vulnerabilities
• Tests security controls effectiveness
• Provides proof of concept for vulnerabilities
• Limited scope and time-bound

Vulnerability Assessment:

• Identifies and classifies vulnerabilities
• Broader scope, less depth
• Automated scanning with some manual verification
• Provides vulnerability inventory

Key Differences:

• Depth: Pen testing goes deeper into exploitation
• Scope: VA covers more systems, pen testing focuses on specific targets
• Risk: Pen testing carries higher risk of system impact
• Output: VA provides vulnerability list, pen testing provides attack scenarios