Data Validation & Encoding A Data Validation & Encoding Data Validation & Encoding 2 Data Validation & Encoding 3 You have invented a new attack against Data Validation and Encoding (no card) Brian can gather information about the underlying configurations, schemas, logic, code, software, services and infrastructure due to the content of error messages, or due to poor configuration, or due to the presence of default installation files or old, test, backup or copies of resources, or exposure of source code Robert can input malicious structured or unstructured data because the allowed protocol format is not being checked, or the structure is not being verified, or the individual data elements are not being validated for format, type, range, length and a whitelist of allowed characters or formats
Data Validation & Encoding Q Data Validation & Encoding K Geoff can inject data into a client or device interpreter because a parameterised interface is not being used, or has not been implemented correctly, or the data has not been encoded correctly for the context, or there is no restrictive policy on code or data includes Gabe can inject data into an server-side interpreter (e.g. SQL, OS commands, Xpath, Server JavaScript, SMTP) because a strongly typed parameterised interface is not being used or has not been implemented correctly (no card) (no card) Authentication A Authentication Authentication 2 Authentication 3 You have invented a new attack against Authentication (no card) James can undertake authentication functions (e.g. attempt to log in, log in with stolen credentials, reset the password) without the real user ever being aware this has occurred Muhammad can obtain a user's password or other secrets such as security questions, by observation during entry, or from a local cache, or in transit, or by reading it from some unprotected location, or because it is widely known, or because it never expires, or because the user cannot change her own password
Read more about this topic in OWASP’s free Authentication Cheat Sheet Authentication 4 Authentication 5 Authentication 6 Authentication 7 Sebastien can easily identify user names or can enumerate them Javier can use default, test or easily guessable credentials to authenticate, or can use an old account or an account not necessary for the application Sven can reuse a temporary password because the user does not have to change it on first use, or it has too long or no expiry Cecilia can use brute force and dictionary attacks against one or many accounts without limit, or these attacks are simplified due to insufficient complexity, length, expiration and re-use requirements for passwords Authentication 8 Authentication 9 Authentication 10 Authentication J Kate can by bypass authentication because it does not fail secure (i.e. it defaults to allowing access) Claudia can undertake more critical functions because authentication requirements are too weak, or there is no requirement to re-authenticate for these Pravin can bypass authentication controls because a centralized standard, tested and approved authentication module/framework/service, separate to the resource being requested, is not being used Mark can access resources or services because is no authentication requirement, or it was assumed authentication would be undertaken by some other system, or was performed in some previous action
Read more about this topic in OWASP’s free Cheat Sheets on Session Management, and Cross Site Request Forgery (CSRF) Prevention Session Management 4 Session Management 5 Session Management 6 Session Management 7 Alison can set session identification cookies on another web application because the domain and path are not restricted sufficiently John can predict or guess session identifiers because they are not changed when the user's role alters (e.g. pre and post authentication) and when switching between non-encrypted and encrypted communications, or are not sufficiently long and random, or are not changed periodically Gary can take over a user's session because there is a long or no inactivity timeout, or a long or no overall session time limit, or the same session can be used from more than one device/location can utilize Adam's session after he has finished, because there is no log out function, or he cannot easily log out, or log out does not properly terminate the session Session Management 8 Session Management 9 Session Management 10 Session Management J Matt can abuse long sessions because the application does not require periodic re-authentication to check if privileges have changed Ivan can steal session identifiers because they are sent over insecure channels, or are logged, or are revealed in error messages, or are included in URLs, or are accessible un-necessarily by code which the attacker can influence or alter Marce can forge requests because per-session, or per-request for more critical actions, strong random tokens or similar are not being used for actions that change state Jeff can resend an identical repeat interaction (e.g. HTTP request, signal, button and it is accepted, not rejected
Session Management Q Session Management K Salim can bypass session management because it is not applied comprehensively and consistently across the application Peter can bypass the session management controls because they have been self-built and/or are weak, instead of using a standard framework or approved tested module (no card) (no card) Authorization A Authorization Authorization 2 Authorization 3 You have invented a new attack against Authorization (no card) Tim can influence data is sent or forwarded to Christian can access (read, update or delete) information, which they should not have permission to, through another mechanism that does have permission (e.g. search indexer, logger, reporting), or because it is cached, or kept for longer than necessary, or other information leakage
Authorization Q Authorization K Christopher can inject a command that the application will run at a higher privilege level Ryan can influence or alter authorization controls and permissions, and can therefore bypass them (no card) (no card) Cryptography A Cryptography Cryptography 2 Cryptography 3 You have invented a new attack against Cryptography (no card) Kyun can access data because it has been obfuscated rather than using an approved cryptographic function Axel can modify transient or permanent data (stored or in transit), or source code, or updates/patches, or configuration data, because it is not subject to integrity checking
Cryptography Q Cryptography K Randolph can access or predict the master cryptographic secrets Dan can influence or alter cryptography code/routines (encryption, hashing, digital signatures, random number and GUID generation) and can therefore bypass them (no card) (no card) Cornucopia A Cornucopia Cornucopia 2 Cornucopia 3 You have invented a new attack of any type (no card) Lee can bypass application controls because dangerous/risky programming language functions have been used instead of safer alternatives, or there are type conversion errors, or because the application is unreliable when an external resource is unavailable, or there are race conditions, or there are resource initialization or allocation issues, or overflows can occur Andrew can access source code, or decompile, or otherwise access business to understand how the application works and any secrets contained
Cornucopia Q Cornucopia K Wild Card Joker Wild Card Joker Jim can undertake malicious, non-normal, actions without detection and response by the application Gareth can utilize the application to deny service to some or all of its users Alice can utilize the application to attack users' systems and data Bob can influence, alter or affect the application so that it no longer complies with legal, regulatory, contractual or other organizational mandates Have you thought about becoming an individual OWASP member? All tools, guidance and local meetings are free for everyone, but individual membership helps support OWASP’s work Examine vulnerabilities and discover how they can be fixed using training applications in the free OWASP Broken Web Applications VM, or using the online challenges in the free Hacking Lab Cut here