Security and Web Applications
Unit 4 Vlab 2 Assessment 1. Injection, Broken Authentication and Session Management, XSS, Insecure Direct Object References, Security Misconfiguration, Sensitive Data Exposure, Missing Function Level Access Control, Cross-Site Request Forgery, Using Components with Known Vulnerabilities, Unvalidated Redirects and Forwards. 2. A Brute force attack in an attack that uses force instead of vulnerabilities to make its way into a site. Usually trying to crack username and password combinations. The risks of these attacks can be mitigated by strengthening password requirements, introducing lockouts when let’s say 3 attempts are made. That would unmotivated and attacker. 3. A user has established a level of privilege with Amazon. AN attacker uses CSRF to exploit the trust of that user. The attacker is posing as the user and is performing actions to get the latest porn film sent to his house. Boom, free porn. 4. SQL Injection, Brute Force, CSRF. 5. Hackers will use web applications with uploading options to upload files that are malicious. 6. A successful SQL injection exploit can read sensitive data from the database, modify database data execute administration operations on the database (such as shutdown the DBMS), recover the content of a given file present on the DBMS file system and in some cases issue commands to the operating system. (https://www.owasp.org/index.php/SQL_Injection) 7. That user information pertaining to that website was downloaded and saved in an output file. 8. First, you must ensure database connections are encrypted. Second, there must be strong authentication, each application should use its own login credentials. Third, you should configure access rights as granularly as possible, giving each application only the privileges it requires.