Final Flashcards
Problems that lead to command injection flaws
Failure to properly separate commands and data
Possibly True SQL Statements
’ or 1=1 – a
Malicious input to drop table ‘users’
’ ; DROP TABLE Users –
Input Validation
PHP Magic Quotes
Example of Parameterized Query
Prepared Statements
Best practice of SQL injection prevention
parameterized queries
Bind variable
? serves as placeholder within SQL
With prepared statements, parameters are bound when?
At runtime
URI
Uniform Resource Identifier
XSS term
buzz word for specific type of Command Injection vulnerability
XSS do what
exploit the trust a user’s browser has for a web server
XSS typically ends in
malicious script run on victim’s host
XSS involves
3 actors:
- attacker
- victim
- server
Why are XSS possible?
Hard to differentiate data from code
Javascript has access to
User’s information such as cookies
Types of XSS Vuln.
- Non-persistent / reflected
- Persistent / stored
- DOM-based / Local
Non-persistent / Reflected XSS
browser data (in url) used by server-side scripts to generate malicious webpage sent back to user
Persistent / Stored XSS
Malicious script provided to web app is stored on server and is used to continue rendering pages
DOM-Based / Local
Malicious script is generated through local client-side DOM processing
Example of non-persitant XSS attack
Eve convinces Alice to click on a URL that makes Bob’s server send Alice a malicious script
Example of Persistant XSS attack
Eve posts message to board with embedded XSS attack script which Bob’s browser reads as code, not data
Real world persistent xss attack
Samy Worm on Myspace
DOM
Document Object Model
XSS Mitigations
- Input validation, sanitation
2. Output encoding
