web-app-security.md

OWASP Top 10 2017

1. Injection (SQL etc.)
2. Broken Authentication
3. Sensitive Data Exposure
4. XML External Entities (XXE)
5. Broken Access Control
6. Security Misconfiguration
7. Cross-Site Scripting (XSS)
8. Insecure Deserialization
9. Using Components with Known Vulnerabilities
10. Insufficient Logging & Monitoring

Beyond The Top 10

High

• Cross-site Request Forgery (CSRF)
• Cross-site Websocket Hijacking (CSWSH)
• Open Redirect
• Path traversal
  • File system paths
  • API/HTTP proxies
  • Use double encoding %252e to bypass simple countermeasures
• window.opener Vulnerabilties

Medium

• Clickjacking
• Browser data not purged on logout
  • Sensitive data stored in cookies, local storage, etc.
  • Back button can retrieve cached data
• Publishing data originating from email
  • https://medium.com/intigriti/how-i-hacked-hundreds-of-companies-through-their-helpdesk-b7680ddc2d4c
• HTTP Parameter pollution
  • Pass multiple parameters with the same name /?user=admin&user=some.user
• Missing certificate validation for TLS

Low

• Account enumeration

Suspicious Areas

• Dependencies
• Hand-rolled encryption of any kind
• Impersonation / Log in as another user
• Login
• Logout
• Processing of uploaded files
• Proxying requests to other servers
• Serving up files specified by the user
• Websockets