Data Validation & Encoding A Data Validation & Encoding Data Validation & Encoding 2 Data Validation & Encoding 3 You have invented a new attack against Data Validation and Encoding (no card) Brian can gather information about the underlying configurations, schemas, logic, code, software, services and infrastructure due to the content of error messages, or due to poor configuration, or due to the presence of default installation files or old, test, backup or copies of resources, or exposure of source code Robert can input malicious structured or unstructured data because the allowed protocol format is not being checked, or the structure is not being verified, or the individual data elements are not being validated for format, type, range, length and a whitelist of allowed characters or formats
Read more about this topic in OWASP’s free Cheat Sheets on Input Validation, XSS (Cross Site Scripting) Prevention, DOM-based XSS Prevention, SQL Injection Prevention, and Query Parameterization Data Validation & Encoding 4 Data Validation & Encoding 5 Data Validation & Encoding 6 Data Validation & Encoding 7 Dave can input malicious data because it is not being checked within the context of the current user and process Jee can bypass the centralized encoding routines since they are not being used comprehensively, or the wrong encodings are being used for the context Jason can bypass the centralized validation routines since they are not being used comprehensively on all inputs Jan can craft special payloads to foil input validation because the character set is not specified/enforced, or the data is encoded multiple times, or the data is not fully converted into the same format the application uses (e.g. canonicalization) before being validated, or variables are not strongly typed Data Validation & Encoding 8 Data Validation & Encoding 9 Data Validation & Encoding 10 Data Validation & Encoding J Sarah can bypass the centralized sanitization routines since they are not being used comprehensively Shamun can bypass input validation or output validation checks because validation failures are not rejected or sanitized Jerry can exploit the trust the application places in a source of data (e.g. user-definable data, manipulation of locally stored data, alteration to state data on a client device, lack of verification of identity such as Jerry can pretend to be Colin) Dennis has control over input validation, output validation or output encoding code/routines so they can be bypassed
Read more about this topic in OWASP’s free Authentication Cheat Sheet Authentication 4 Authentication 5 Authentication 6 Authentication 7 Sebastien can easily identify user names or can enumerate them Javier can use default, test or easily guessable credentials to authenticate, or can use an old account or an account not necessary for the application Sven can reuse a temporary password because the user does not have to change it on first use, or it has too long or no expiry Cecilia can use brute force and dictionary attacks against one or many accounts without limit, or these attacks are simplified due to insufficient complexity, length, expiration and re-use requirements for passwords Authentication 8 Authentication 9 Authentication 10 Authentication J Kate can by bypass authentication because it does not fail secure (i.e. it defaults to allowing access) Claudia can undertake more critical functions because authentication requirements are too weak, or there is no requirement to re-authenticate for these Pravin can bypass authentication controls because a centralized standard, tested and approved authentication module/framework/service, separate to the resource being requested, is not being used Mark can access resources or services because there is no authentication requirement, or it was assumed authentication would be undertaken by some other system, or was performed in some previous action
Session Management Q Session Management K Salim can bypass session management because it is not applied comprehensively and consistently across the application Peter can bypass the session management controls because they have been self-built and/or are weak, instead of using a standard framework or approved tested module (no card) (no card) Authorization A Authorization Authorization 2 Authorization 3 You have invented a new attack against Authorization (no card) Tim can influence where data is sent or forwarded to Christian can access (read, write, update or delete) information, which they should not have permission to, through another mechanism that does have permission (e.g. search indexer, logger, reporting), or because it is cached, or other information leakage
Read more about this topic in OWASP’s Development and Testing Guides Authorization 4 Authorization 5 Authorization 6 Authorization 7 Kelly can bypass authorization controls because they do not fail securely (i.e. they default to allowing access) Chad can access resources (including services, processes, AJAX, Flash, video, images, documents, temporary files, session data, system properties, configuration data, registry settings, logs) he should not be able to due to missing authorization, or due to excessive privileges (e.g. not using the principle of least privilege) Eduardo can access data he does not have permission to, even though he has permission to the form/page/URL/entry point Yuanjing can access application functions, objects, or properties he is not authorized to access Authorization 8 Authorization 9 Authorization 10 Authorization J Tom can bypass business rules by altering the usual process sequence or flow, or by undertaking the process in the incorrect order, or by manipulating date and time values used by the application, or by using valid features for unintended purposes, or by otherwise manipulating control data Mike can misuse an application by using a valid feature too fast, or too frequently, or other way that is not intended, or consumes the application's resources, or causes race conditions, or a feature Richard can bypass the centralized authorization controls since they are not being used comprehensively on all interactions Dinis can access security configuration information, or access control lists
Read more about this topic in OWASP’s free Cheat Sheets on Cryptographic Storage, and Transport Layer Protection Cryptography 4 Cryptography 5 Cryptography 6 Cryptography 7 Paulo can access data in transit that is not encrypted, even though the channel is encrypted Kyle can bypass cryptographic controls because they do not fail securely (i.e. they default to unprotected) Romain can read and modify data in transit (e.g. cryptographic secrets, credentials, session identifiers, personal and commercially-sensitive data), in communications within the application, or between the application and users, or between the application and external systems Gunter can intercept or modify encrypted data in transit because the protocol is poorly deployed, or weakly configured, or certificates are invalid, or certificates are not trusted, or the connection can be degraded to a weaker or un-encrypted communication Cryptography 8 Cryptography 9 Cryptography 10 Cryptography J Eoin can access stored business data (e.g. passwords, session identifiers, PII, cardholder data) because it is not securely encrypted or securely hashed Andy can bypass random number generation, random GUID generation, hashing and encryption functions because they have been self-built and/or are weak Susanna can break the cryptography in use because it is not strong enough for the degree of protection required, or it is not strong enough for the amount of effort the attacker is willing to make Justin can read credentials for accessing internal or external resources, services and others systems because they are stored in an unencrypted format, or saved in the source code
Read more about application security in OWASP’s free Guides on Requirements, Development, Code Review and Testing, the Cheat Sheet series, and the Open Software Assurance Maturity Model Cornucopia 4 Cornucopia 5 Cornucopia 6 Cornucopia 7 Keith can perform an action and it is not possible to attribute it to him Larry can influence the trust other parties including users have in the application, or abuse that trust elsewhere (e.g. in another application) Aaron can bypass controls because error/exception handling is missing, or is implemented inconsistently, or is partially implemented, or does not deny access by default (i.e. errors terminate access/execution), or relies on handling by some other service or system Mwengu's actions cannot be investigated because there is not an adequate accurately record of security events, or there is not a full audit trail, or these can be altered or deleted by Mwengu, or there is no centralized logging service Cornucopia 8 Cornucopia 9 Cornucopia 10 Cornucopia J David can bypass the application to gain access to data because the network and host infrastructure, and supporting services/applications, have not been securely configured, the configuration rechecked periodically and security patches applied, or the data is stored locally, or the data is not physically protected Michael can bypass the application to gain access to data because administrative tools or administrative interfaces are not secured adequately Xavier can circumvent the application's controls because code frameworks, libraries and components contain malicious code or vulnerabilities (e.g. commercial off the shelf, outsourced, open source, externally-located) Roman can exploit the application because it was compiled using out-of-date tools, or its configuration is not secure by default, or security information was not documented and passed on to operational teams