Web Attacks and Countermeasures

Web Attacks and Defense

1. Introduction

Exactly what is a web application? Why web applications are the initial target for online hackers? Do you know the attacks Web applications usually face, preventing from all of these attacks. We begin in the various web application attacks. This information is split into three areas including kinds of attacks, countermeasures and risk factor.

2. ATTACKS

Following are the most typical web application attacks.

a. Remote code execution

b. SQL injection

c. Format string vulnerabilities

d. Mix Site Scripting (XSS)

e. Username enumeration

Remote Code Execution

As suggested by its name, this vulnerability enables an assailant to operate arbitrary, system level code around the vulnerable web application server and retrieve any preferred information contained within. Improper coding errors result in this vulnerability. At occasions, it is not easy to uncover this vulnerability during transmission testing assignments but such troubles are frequently revealed while carrying out a source code review. However, when testing Web applications is remember this that exploitation of the vulnerability can result in total system compromise with similar legal rights because the Server is running with.

SQL Injection

SQL injection is an extremely old approach but it is still well-liked by attackers. This method enables an assailant to retrieve crucial information from the Web server’s database. With respect to the application’s safety measures, the outcome of the attack can differ from fundamental information disclosure to remote code execution and total system compromise.

Format String Vulnerabilities

This vulnerability is a result of using unfiltered user input because the format string parameter in a few Perl or C functions that perform formatting, for example C’s printf().

A malicious user could use the %s and %x format tokens, amongst others, to print data in the stack or even areas in memory. You can also write arbitrary data to arbitrary locations while using %n format token, which instructions printf() and other alike functions to create back the amount of bytes formatted. This really is presuming the corresponding argument exists and it is of type int *.

Format string vulnerability attacks fall under three general groups: denial and services information, studying and writing.

Mix Site Scripting

The prosperity of this attack necessitates the victim to carry out a malicious URL which can be crafted in this manner to seem to be legitimate initially look. When visiting this type of crafted URL, an assailant can effectively execute something malicious within the victim’s browser. Some malicious JavaScript, for instance, is going to be run poor the site which offers the XSS bug.

Username enumeration

Username enumeration is a kind of attack in which the backend validation script informs the attacker when the provided username is true or otherwise. Exploiting this vulnerability helps the attacker to test out different usernames and see valid ones with the aid of these different error messages.

3. Countermeasures

Username enumerations:

Display consistent error messages to avoid disclosure of valid usernames. Make certain if trivial accounts happen to be produced for testing purposes their passwords are generally not trivial or these accounts are absolutely removed after tests are over – and prior to the application is defined online.

Mix site scripting:

Input validation, secure programming and use of good language for dynamic web applications.

SQL Injection:

Avoid connecting towards the database like a super user or because the database owner. Always employ customized database users using the minimum needed rights needed to do the assigned task. Perform input validation and don’t give error response on client side.

Format String:

Edit the origin code so the input is correctly verified.

Remote code execution:

It’s an absolute must to sanitize all user input before processing it. So far as possible, stay away from covering instructions. However, if they’re needed, make sure that only filtered information is accustomed to construct the string to become performed and make certain to flee the output

4. Risks

SQL Injection:

Rating: Moderate to Highly Critical

Remote Code Execution:

Rating: Highly Critical

Mix Site Scripting:

Rating: Less Critical

Username Enumeration

Rating: Less

5. Summary

This is actually the short article to build up awareness on web attacks and countermeasures, they are common web application attacks.