Data Validation & Encoding A Data Validation & Encoding Data Validation & Encoding 2 Data Validation & Encoding 3 You have invented a new attack against Data Validation and Encoding (no card) Brian can gather information about the underlying configurations, schemas, logic, code, software, services and infrastructure due to the content of error messages, or due to poor configuration, or due to the presence of default installation files or old, test, backup or copies of resources, or exposure of source code Robert can input malicious structured or unstructured data because the allowed protocol format is not being checked, or the structure is not being verified, or the individual data elements are not being validated for format, type, range, length and a whitelist of allowed characters or formats
Read more about this topic in OWASP’s free Authentication Cheat Sheet Authentication 4 Authentication 5 Authentication 6 Authentication 7 Sebastien can easily identify user names or can enumerate them Javier can use default, test or easily guessable credentials to authenticate, or can use an old account or an account not necessary for the application Sven can reuse a temporary password because the user does not have to change it on first use, or it has too long or no expiry Cecilia can use brute force and dictionary attacks against one or many accounts without limit, or these attacks are simplified due to insufficient complexity, length, expiration and re-use requirements for passwords Authentication 8 Authentication 9 Authentication 10 Authentication J Kate can by bypass authentication because it does not fail secure (i.e. it defaults to allowing access) Claudia can undertake more critical functions because authentication requirements are too weak, or there is no requirement to re-authenticate for these Pravin can bypass authentication controls because a centralized standard, tested and approved authentication module/framework/service, separate to the resource being requested, is not being used Mark can access resources or services because there is no authentication requirement, or it was assumed authentication would be undertaken by some other system, or was performed in some previous action
Authentication Q Authentication K Jaime can bypass authentication because it is not enforced comprehensively across all entry points, modules, functions, content and other data, or is not applied with equal rigor for all types of authentication functionality (e.g. register, password change, password change, log out, administration) Olga can influence or alter authentication code/routines so they can be bypassed (no card) (no card) Session Management A Session Management Session Management 2 Session Management 3 You have invented a new attack against Session Management (no card) William has control over the generation of session identifiers Ryan can use a single account in parallel since concurrent sessions are allowed
Read more about this topic in OWASP’s free Cheat Sheets on Cryptographic Storage, and Transport Layer Protection Cryptography 4 Cryptography 5 Cryptography 6 Cryptography 7 Paulo can access data in transit that is not encrypted, even though the channel is encrypted Kyle can bypass cryptographic controls because they do not fail securely (i.e. they default to unprotected) Romain can read and modify data in transit (e.g. cryptographic secrets, credentials, session identifiers, personal and commercially-sensitive data), in communications within the application, or between the application and users, or between the application and external systems Gunter can intercept or modify encrypted data in transit because the protocol is poorly deployed, or weakly configured, or certificates are invalid, or certificates are not trusted, or the connection can be degraded to a weaker or un-encrypted communication Cryptography 8 Cryptography 9 Cryptography 10 Cryptography J Eoin can access stored business data (e.g. passwords, session identifiers, PII, cardholder data) because it is not securely encrypted or securely hashed Andy can bypass random number generation, random GUID generation, hashing and encryption functions because they have been self-built and/or are weak Susanna can break the cryptography in use because it is not strong enough for the degree of protection required, or it is not strong enough for the amount of effort the attacker is willing to make Justin can read credentials for accessing internal or external resources, services and others systems because they are stored in an unencrypted format, or saved in the source code
Cryptography Q Cryptography K Randolph can access or predict the master cryptographic secrets Dan can influence or alter cryptography code/routines (encryption, hashing, digital signatures, random number and GUID generation) and can therefore bypass them (no card) (no card) Cornucopia A Cornucopia Cornucopia 2 Cornucopia 3 You have invented a new attack of any type (no card) Lee can bypass application controls because dangerous/risky programming language functions have been used instead of safer alternatives, or there are type conversion errors, or because the application is unreliable when an external resource is unavailable, or there are race conditions, or there are resource initialization or allocation issues, or overflows can occur Andrew can access source code, or decompile, or otherwise access business logic to understand how the application works and any secrets contained
Cornucopia Q Cornucopia K Wild Card Joker Wild Card Joker Jim can undertake malicious, non-normal, actions without detection and response by the application Gareth can utilize the application to deny service to some or all of its users Alice can utilize the application to attack users' systems and data Bob can influence, alter or affect the application so that it no longer complies with legal, regulatory, contractual or other organizational mandates Have you thought about becoming an individual OWASP member? All tools, guidance and local meetings are free for everyone, but individual membership helps support OWASP’s work Examine vulnerabilities and discover how they can be fixed using training applications in the free OWASP Broken Web Applications VM, or using the online challenges in the free Hacking Lab Cut here