Web Application Security

Application security :

Some of the following Application security is exist in web development, These are in the order of most attacked at the level 1,

1 - Cross site scripting
2 - SQL Injection
3 - File Upload
4 - Cross site request forgery
5 - Local file inclusion
6 - Remote code execution
7 - Full path disclosure
8 - Remote file inclusion
9 - Authentication Bypass
10 - General bypass
11 - Open direct
12 - XML external entity
13 - Denial of services

1 - Cross site scripting (also known as XSS):  

XSS vulnerabilities target scripts embedded in a page that are executed on the client-side (in the user’s web browser) rather than on the server-side.

Let suppose end user fill the form and put the script tag in the textfield, this script is stored in the database field.  When this field shows in the web then this script would be executed and harm the web , Some common attacks are like , change the image source , fire any event, or steal the cookies.

Cookies are a file which is stored in the computer, if any attacker steal my cookies then he can login my account without the credentials.

XSS are two types : 

1 - Stored XSS : like add script tag in textfield and save in db, if anyone visit the site the script would be executed, it's called the Stored XSS attack.

2 - Reflected XSS : like anyone send me a url with script tag , when we hit this url it will executed, it means it is only executed when we click that link. it is called the reflected XSS.

2 - SQL Injection : 

SQL injection usually occurs when you ask a user for input, like their username/userid, and instead of a name/id, the user gives you an SQL statement that you will unknowingly run on your database.

let's suppose we create the textfield called user id, user fill the userid and based on it we fire the query and display the result , 

like 

txtSQL = "SELECT * FROM Users WHERE UserId = " + txtUserId;

But the end use did not enter the user id while it fill the sql statement,

like

105 OR 1=1

so now the query would be 

SELECT * FROM Users WHERE UserId = 105 OR 1=1;

The SQL above is valid and will return ALL rows from the "Users" table, since OR 1=1 is always TRUE.

Type of SQL injection :

1 - In-Band SQL Injection : The example is above, when user executes the the command ans can see the result,

2 - Blind SQL Injection : In this attack the attacker change the structure of the db, but can not see the result , that why it is called the blind SQLI.

3 - Out of Bound SQL Injection : 

Steps to prevent SQL injection attacks : 

1 - use the mysql_real_escape_string function in mysql , it escape(remove) the special character , so if anyone add and sql statement in the textfield it will return to FALSE,

2 - Using Prepared Statements : use the prepare statement with placeholders , like drupal 8 query

$stmt = $dbh->prepare("SELECT * FROM users WHERE USERNAME = ? AND PASSWORD = ?");

$stmt->execute(array($username, $password));

PHP 5.5, procedural MySQL has been deprecated and will soon be removed entirely. This means that future software projects will need to be switched to either MySQLi or PDO MySQL in order to continue to work

Cross site request forgery : 

Let say i use internet banking, and login my account, so a new session is created , when the use login it create a cookie file in user system, it has the session id and expiration time to expire. when we hit the http request every time the stored cookie is also hit to the server to verify the use is login or not.

now i am attacker and i create a link with this link transfer transfer the money to my account. so if the login user hit the link then the script executed and transfered the account to my account. just because the user is already login so it will executed no doubt.

To Prevent it we create CSRF token, like in drupal every form has a CSRF token in hidden field.