Data Validation & Encoding A Data Validation & Encoding Data Validation & Encoding 2 Data Validation & Encoding 3 You have invented a new attack against Data Validation and Encoding (no card) Brian can gather information about the underlying configurations, schemas, logic, code, software, services and infrastructure due to the content of error messages, or poor configuration, or the presence of default installation files or old, test, backup or copies of resources, or exposure of source code Robert can input malicious data because the allowed protocol format is not being checked, or the structure is not being verified, or the individual data elements are not being validated for format, type, range, length and a whitelist of allowed characters or formats
Data Validation & Encoding Q Data Validation & Encoding K can inject data into a client or device interpreter because a parameterised interface is not being used, or has not been implemented correctly, or the data has not been encoded correctly for the context, or there is no restrictive policy on code or data includes Gabe can inject data into an server-side interpreter (e.g. SQL, OS commands, Xpath, Server JavaScript, SMTP) because a strongly typed parameterised interface is not being used or has not been implemented correctly (no card) (no card) Authentication A Authentication Authentication 2 Authentication 3 You have invented a new attack against Authentication (no card) James can undertake authentication functions (e.g. attempt to log in, log in with stolen credentials, reset the password) Muhammad can obtain a user's password or other secrets such as security questions, by observation during entry, or from a local cache, or in transit, or by reading it from some unprotected location, or because it is widely known, or because it never expires, or because the user cannot change her own password
Authentication Q Authentication K can bypass authentication because it is not enforced with equal rigor for all types of authentication functionality (e.g. register, password change, password recovery, log out, administration) Olga can influence or alter authentication code/routines so they can be bypassed (no card) (no card) Session Management A Session Management Session Management 2 Session Management 3 You have invented a new attack against Session Management (no card) William has control over the generation of session identifiers Ryan can use a single account in parallel concurrent sessions are allowed
Read more this topic in OWASP’s free Cheat Sheets on Session Management, and Cross Site Request Forgery (CSRF) Prevention Session Management 4 Session Management 5 Session Management 6 Session Management 7 Alison can set session identification cookies on another web application because the domain and path are not restricted sufficiently John can predict or guess session identifiers because they are not changed when the user's role alters (e.g. pre and post authentication) and when switching between non-encrypted and encrypted communications, or are not sufficiently long and random, or are not changed periodically Gary can take over a user's session because there is a long or no inactivity timeout, or a long or no overall session time limit, or the same session can be used from more than one device/location Casey can utilize Adam's session after he has finished, because there is no log out function, or he cannot easily log out, or log out does not properly terminate the session Session Management 8 Session Management 9 Session Management 10 Session Management J Matt can abuse long sessions because the application does not require periodic re-authentication to check if privileges have changed Ivan can steal session identifiers because they are sent over insecure channels, or are logged, or are revealed in error messages, or are included in URLs, or are accessible un-necessarily by code which the attacker can influence or alter Marce can forge requests because per-session, or per-request for more critical actions, strong random tokens or similar are not being used for actions that change state Jeff can resend an identical repeat interaction (e.g. HTTP request, signal, button press) and it is accepted, not rejected
Read more about this topic in OWASP’s Development and Testing Guides Authorization 4 Authorization 5 Authorization 6 Authorization 7 Kelly can bypass authorization controls because they do not fail securely (i.e. they default to allowing access) Chad can access resources (including services, processes, AJAX, Flash, video, images, documents, temporary files, session data, system properties, configuration data, registry settings, logs) he should not be able to due to missing authorization, or due to excessive privileges (e.g. not using the principle of least privilege) Eduardo can access data he does not have permission to, even though he has permission to the form/page/URL/entry point Yuanjing can access application functions, objects, or properties he is not authorized to access Authorization 8 Authorization 9 Authorization 10 Authorization J Tom can bypass business rules by altering the usual process sequence or flow, or by undertaking the process in the incorrect order, or by manipulating date and time values used by the application, or by using valid features for unintended purposes, or by otherwise manipulating control data Mike can misuse an application by using a valid feature too fast, or too frequently, or other way that is not intended, or consumes the application's resources, or causes race conditions, or a feature Richard can bypass the centralized authorization controls since they are not being used comprehensively on all interactions Dinis can access security configuration information, or access control lists
Read more about this topic in OWASP’s free Cheat Sheets on Cryptographic Storage, and Transport Layer Protection Cryptography 4 Cryptography 5 Cryptography 6 Cryptography 7 can access data in transit that is not encrypted, even though the channel is encrypted Kyle can bypass cryptographic controls because they do not fail securely (i.e. they default to unprotected) Romain can read and modify data in transit (e.g. cryptographic secrets, credentials, session identifiers, personal and commercially-sensitive data), in communications within the application, or between the application and users, or between the application and external systems Gunter can intercept or modify encrypted data in transit because the protocol is poorly deployed, or weakly configured, or certificates are invalid, or certificates are not trusted, or the connection can be degraded to a weaker or un-encrypted communication Cryptography 8 Cryptography 9 Cryptography 10 Cryptography J Eoin can access stored business data (e.g. passwords, session identifiers, PII, cardholder data) because it is not securely encrypted or securely hashed Andy can bypass random number generation, random GUID generation, hashing and encryption functions because they have been self-built and/or are weak Susanna can break the cryptography in use because it is not strong enough for the degree of protection required, or it is not strong enough for the amount of effort the attacker is willing to make Justin can read credentials for accessing internal or external resources, services and others systems because they are stored in an unencrypted format, or in the source code
Cornucopia Q Cornucopia K Wild Card Joker Wild Card Jim can undertake malicious, non-normal, actions without detection and response by the application Gareth can utilize the application to deny service to some or all of its users can utilize the application to attack users' systems and data Bob can influence, or affect the application so that it no longer complies with legal, regulatory, contractual or other organizational mandates Have you thought about becoming an individual OWASP member? All tools, guidance and local meetings are free for everyone, but individual membership helps support OWASP’s work Examine vulnerabilities and discover how they can be fixed using training applications in the free OWASP Broken Web Applications VM, or using the online challenges in the free Hacking Lab Cut here