OWASP Top Ten Threats

Question 1

Broken Authorization and how to avoid it.

Answer 1

Authenticated users without authorization perform horizontal privilege escalation.

Prevention:

• Enforce Least privilege
• Default deny
• Authorize every request
• Review authorization logic
• Prefer ABAC over RBAC
• Avoid IDOR (e.g. https:/mybank.com/?acct_id=901)
• Protect static resources (e.g. S3 buckets)
• Auth checks in right location (e.g. not in client side logic).
• Logging
• Unit and Integration testing

Question 2

XSS Prevention -Cheat Sheet

Answer 2

• RULE #0 - Never Insert Untrusted Data Except in Allowed Locations
• RULE #1 - HTML Encode Before Inserting Untrusted Data into HTML Element Content - this essentially turns special characters such as &, , “ and ‘ into encoded elements such as &amp, &lt etc..
• Other rules are similar but cover Java Script, CSS

Question 3

What is CSRF?

Answer 3

• Cross-Site Request Forgery (CSRF) is an attack that forces an end user to execute unwanted actions on a web application in which they’re currently authenticated.

Question 4

How is CSRF different from XSS?

Answer 4

• XSS exploits a user’s trust in the web application

- CSRF exploits a web application’s trust in the user.

Question 5

How can CSRF be prevented?

Answer 5

• On the application side: Using random session tokens
  and CAPTCHAs.
• On the user side: logout of applications, do not browse at the same time as you use banking applications; do not click on links; do not store passwords in browsers.

Question 6

What is unvalidated redirect and forward?

Answer 6

Web application redirects user to a malicious website provided in untrusted input.

1. User receives phishing email with link to a known page with a redirect parameter to attacker site.
2. User clicks on link and is redirected to the attacker’s page.

Avoid it by avoidng redirects and forwards.
Train users - since such attempts are often linked with phishing emails.

Question 7

What are the OWASP top 10?

Answer 7

1. Injection SQL/XML/LDAP
2. Broken Auth & Session Management
3. XSS
4. IDOR
5. Security Misconfiguration
6. Sensitive Data Exposure
7. Missing Functional Level Access Control
8. CSRF
9. Components with known vulnerability
10. Unvalidated fwds/requests.