Web Security

CSRF(Cross site request forgery)

1. Attacker crafts a request to a website that the victim has access to.
2. Victim is tricked to submit the request which he doesn't intend to.
3. Victim tricked to changing  his personal information with attackers mobile/email.

How To Fix: This attack can be protected by including csrf token in web forms which keeps changing for every request and every user. Referrer header is another option.

Session fixation

1. Attacker creates a session by accessing a malicious site.
2. Persuades victim to login to the site with the same session id. 
3. Attacker uses the same session and impersonate victim

How To Fix: This attack can be prevented by creating a new session whenever user logs in.

HSTS(HTTP Strict transport security)

1. If the https protocol is omitted in the url, victim will be allowed to access the un-secured site.
2. Since, the communication is not secured via http, victim will potentially be vulnerable to man in the middle attacks.
3. Attacker can view the network traffic between the victim and the site, intercept it and change it.

How To Fix:  Adding Strict-Transport-Security to the response header fixes this vulnerability and tells the browser to treat the site as https

Strict-Transport-Security: max-age=31536000 ; includeSubDomains

XSS (Cross site scripting)

1. Attacker manipulates the website to return malicious javascript in the response.
2. Whenever that scirpt gets executed in the victims's browser, it sends the sensitive information of the victim to the attacker such as cookie information.
3. Now, Attacker can impersonate as a victim, can access the malicious website and do what victim is priviliged to do on it.

How To Fix:

• Validating the input, Encoding the output, use appropriate content-type response header are used to prevent this attack.
• CSP and X-XSS-Protection are other mechanisms to protect against this vulnerability using response headers

Content-Security-Policy: script-src https://trustedscripts.example.com - Any attempt to load a script from any source other than what is declared in script-src will be deinied

X-XSS-Protection: 1; mode=block - Response header hints browser to block the cross site script

SQL Injection

1. Attacker manipulates SQL queries by injecting malicious i/p to the web page.
2. SQL returns sensitive information back to the web page.

How To Fix:  Stop writing dynanic queries, Using prepared statements, whitelisting input

DOS(Denial of service)/DDOS(Distributed denial of service):

1. Attack which makes an application to perform slowly.
2. Attacker attacks the site repeatedly and cause resource outage

How To Fix: Define a load limit, which specifies the number of users allowed to access any given resource at any given time.

X-Rate-Limit-Limit HTTP header is the rate limit ceiling for that given request.

X-Rate-Limit-Remaining HTTP header the number of requests left for the 60 seconds window.

CheatSheet-DDOS