Google Gruyere - danniel-giri/SEC-250 GitHub Wiki

UID: 629051908848610379657298320444748776200

1. Reflection questions Which OWASP Top 10 category (or categories) does this fit into? (owasp.org/Top10)

This fits into the injection category because it is a form of XSS

What kind of impact could this vulnerability have?

This vulnerability can allow attackers to run commands on a server and gain unauthorized access to data or run malicious code on the server

How would you fix this vulnerability?

By keeping the data separate from commands and queries using a safe API or using server-side validation to validate inputs

2. Reflection questions Which OWASP Top 10 category (or categories) does this fit into? (owasp.org/Top10)

This fits into injection because it is a form of XSS

What kind of impact could this vulnerability have?

This vulnerability allows code to be run when the URL is accessed without being validated/sanitized

How would you fix this vulnerability?

The way this vulnerability would be fixed is by having the user-input be sanitized before anything is loaded on the website

3. Reflection questions Which OWASP Top 10 category (or categories) does this fit into? (owasp.org/Top10)

This fits into injection because it is a form of XSS

What kind of impact could this vulnerability have?

It allows for scripts to be run when people open a profile that contains the script in it

How would you fix this vulnerability?

The way to fix this vulnerability is by validating any user-input before it is loaded on the web browser

4. Reflection questions Which OWASP Top 10 category (or categories) does this fit into? (owasp.org/Top10)

This fits into broken access controls because it allows you to elevate your privileges

What kind of impact could this vulnerability have?

This vulnerability could allow people to gain administrative privileges and gain access to data they shouldn't have access to

How would you fix this vulnerability?

Implement access controls such as authentication methods, denying access to any non-public data by default, and logging account login attempts

5. Reflection questions Which OWASP Top 10 category (or categories) does this fit into? (owasp.org/Top10)

This fits into injection and broken access control because it is a form of XSS and allows unauthorized access to private data

What kind of impact could this vulnerability have?

This allows people to read your private account information which gives them unauthorized access to your account and its information.

How would you fix this vulnerability?

The way to fix this vulnerability is by having the default access controls for the private data be that only the owner of the account can see it

6. Reflection questions Which OWASP Top 10 category (or categories) does this fit into? (owasp.org/Top10)

This fits into injection and broken access controls because it is a form of XSS and allows you to get out of the folder it was supposed to be in.

What kind of impact could this vulnerability have?

This vulnerability could allow you to run your own code on the server and also gain root access if you keep going up directories.

How would you fix this vulnerability?

The way I would fix this vulnerability is by sanitizing and validating all inputs before they are loaded and run on the server.

7. Reflection questions Which OWASP Top 10 category (or categories) does this fit into? (owasp.org/Top10)

The categories this fits into is security misconfiguration and broken access control

What kind of impact could this vulnerability have?

This allows people to be able to access data they are not supposed to see due to the developer mode not being secured properly or turned off

How would you fix this vulnerability?

Requiring authentication for developer mode/admin privileges

The category this fits into is injection

What kind of impact could this vulnerability have?

It allows you to run your own code on the server which can expose sensitive data

How would you fix this vulnerability?

The way to fix this vulnerability is by utilizing input validation or sanitization

9. Reflection questions Which OWASP Top 10 category (or categories) does this fit into? (owasp.org/Top10)

The category this fits into is mishandling of exceptional conditions

What kind of impact could this vulnerability have?

This could cause entire websites to be shutdown for long periods of time

How would you fix this vulnerability?

The way to fix this vulnerability would be by utilizing a monitoring tool to detect an excessive amount of repeated errors or requests

Wrap-Up Once you've wrapped up all 9 challenges, look back over your reflection answers and chew on these:

Which of these ten bugs could a teammate have caught just by reviewing the code, before the app ever shipped?

Of these 10 bugs, the last one could've been caught before the app ever shipped just by reviewing the code.

Which ones would only ever show up by actually running and attacking the app?

The white-box attacks need the app to be running in order to be attacked

If you could only add one fix to Gruyere's codebase to wipe out the most bugs at once, what would it be, and why?

I would add input validation because that would remove/make XSS attacks more difficult to execute