Topic Category: OWASP
Example Scenario – Cross Site Scripting (XXS) Scenario #1: The application uses untrusted data without validation or escaping, in the following HTML snippet: (String) page += “<input name=’creditcard’ type=’TEXT’ …
How to Prevent – Cross Site Scripting (XXS) In order to prevent XSS, it is important to separate untrusted data from active browser content. This separation can be achieved …
More Resources – Security Misconfiguration OWASP Resources OWASP Testing Guide: Configuration Management OWASP Testing Guide: Testing for Error Codes OWASP Security Headers Project For additional requirements in this area, …
Example Scenarios – Security Misconfiguration Scenario #1: Default sharing permissions are open to the Internet on a Cloud Service Provider. This allows sensitive data stored within cloud storage to …
How to Prevent – Security Misconfiguration Prevention boils down to proper implementation of security measure during installation, upgrades or major changes. Here are some preventive steps to take against …
More Resources – Broken Access Control OWASP Resources OWASP Proactive Controls: Access Controls OWASP Application Security Verification Standard: V4 Access Control OWASP Testing Guide: Authorization Testing OWASP Cheat Sheet: …
Example Scenarios – Broken Access Control Scenario #1: Assume the application is accessing account information in a SQL call using unverified data: pstmt.setString(1, request.getParameter(“acct”)); ResultSet results = pstmt.executeQuery( ); …
How to Prevent – Broken Access Control Access control measures are only effective where the attacker cannot modify the access control check or metadata. This can effectively done only …
More Resources – XML External Entities (XXE) OWASP Resources OWASP Application Security Verification Standard OWASP Testing Guide: Testing for XML Injection OWASP XXE Vulnerability OWASP Cheat Sheet: XXE Prevention …
Example Scenarios – XML External Entities (XXE) Scenario #1: An attacker attempts a denial-of-service attack by including a potentially endless file: <!ENTITY xxe SYSTEM “file:///dev/random” >]> Scenario #2: The …
