Data Validation & Encoding A Data Validation & Encoding Data Validation & Encoding 2 Data Validation & Encoding 3 You have invented a new attack against Data Validation and Encoding (no card) Brian can gather information about the underlying configurations, schemas, logic, code, software, services and infrastructure due to the content of error messages, or due to poor configuration, or due to the presence of default installation files or old, test, backup or copies of resources, or exposure of source code Robert can input malicious structured or unstructured data because the allowed protocol format is not being checked, or the structure is not being verified, or the individual data elements are not being validated for format, type, range, length and a whitelist of allowed characters or formats Read more about this topic in OWASP’s free Cheat Sheets on Input Validation, XSS Prevention, DOM-based XSS Prevention, SQL Injection Prevention, and Query Parameterization 4 & 5 & 6 & 7
Jaime can bypass authentication because it is not enforced comprehensively across all entry points, modules, functions, content and other data, or is not applied with equal rigor for all types of authentication functionality (e.g. register, password change, password change, log out, administration) Olga can influence or alter authentication code/routines so they can be bypassed (no card) (no card) Session Management A Session Management Session Management 2 Session Management 3 You have invented a new attack against Session Management (no card) William has control over the generation of session identifiers Ryan can use a single account in parallel since concurrent sessions are allowed Read more about this topic in OWASP’s free Cheat Sheets on Session Management, and Cross Site Request Forgery (CSRF) Prevention 4 5 6 7
Kelly can bypass authorization controls because they do not fail securely (i.e. they default to allowing access) Chad can access resources (including services, processes, AJAX, Flash, video, images, documents, temporary files, session data, system properties, configuration data, registry settings, logs) he should not be able to due to missing authorization, or due to excessive privileges (e.g. not using the principle of least privilege) Eduardo can access data he does not have permission to, even though he has permission to the form/page/URL/entry point Yuanjing can access application functions, objects, or properties he is not authorized to access Authorization 8 Authorization 9 Authorization 10 Authorization J Tom can bypass business rules by altering the usual process sequence or flow, or by undertaking the process in the incorrect order, or by manipulating date and time values used by the application, or by using valid features for unintended purposes, or by otherwise manipulating control data Mike can misuse application by using a valid feature too fast, or too frequently, or other way that is not intended, or consumes the application's resources, or causes race conditions, or a feature Richard can bypass the centralized authorization controls since they are not being used comprehensively on all interactions Dinis can access security configuration information, or access control lists Q K
Paulo can access data in transit that is not encrypted, even though the channel is encrypted Kyle can bypass cryptographic controls because they do not fail securely (i.e. they default to unprotected) Romain can read and modify data in transit (e.g. cryptographic secrets, credentials, session identifiers, personal and commercially-sensitive data), in communications within the application, or between the application and users, or between the application and external systems Gunter can intercept or modify encrypted data in transit because the protocol is poorly deployed, or weakly configured, or certificates are invalid, or certificates are not trusted, or the connection can be degraded to a weaker or un-encrypted communication Cryptography 8 Cryptography 9 Cryptography 10 Cryptography J Eoin can access stored business data (e.g. passwords, session identifiers, PII, cardholder data) because it is not securely encrypted or securely hashed Andy can bypass random number generation, random GUID generation, hashing and encryption functions because they have been self-built and/or are weak Susanna can break the cryptography in use because it is not strong enough for the degree of protection required, or it is not strong enough for the amount of effort the attacker is willing to make Justin can read credentials for accessing internal or external resources, services and others systems because they are stored in an unencrypted format, or saved in the source code Q K
Randolph can access or predict the master cryptographic secrets Dan can influence or alter cryptography code/routines (encryption, hashing, digital signatures, random number and GUID generation) and can therefore bypass them (no card) (no card) Cornucopia A Cornucopia Cornucopia 2 Cornucopia 3 You have invented a new attack of any type (no card) Lee can bypass application controls because dangerous/risky programming language functions have been used instead of safer alternatives, or there are type conversion errors, or because the application is unreliable when an external resource is unavailable, or there are race conditions, or there are resource initialization or allocation issues, or overflows can occur Andrew can access source code, or decompile, or otherwise access business logic to understand how the application works and any secrets contained Read more about application security in OWASP’s free Guides on Requirements, Development, Code Review and Testing, the Cheat Sheet series, and the Open Software Assurance Maturity Model 4 5 6 7