Hello, and welcome to the next video on top
10 Bourbons liberties.
Known this video. What we are going to lunch. So we are going
to learn about Topo Liberties for applications.
Nevada. I'm inside gallons machine and we are learning about West
Stockton Rebel liberties.
So the previous video of
you have learned that the box of fruit can scan various kind of
Liberty's inside web applications. Now, we need
to focus on top 10 Bible Liberties cause
of the article.
Call Jairo Liberty's, so.
Let me show you.
Wake me up in Google here, and you
can drive here.
Top 10 celebrities.
Call Babe.
All right. Here we go. So this is the
official website OS. And this is
the lynx electric vehicle. Open it.
Here we go.
So this is top 10 Bollywood. He's
for replication provided by OS.
So you can see you. The old west top 10 is
a standard of Ernest document for dollar bills and live application security.
It represents a broad consensus about
the most critical security risk of applications. To
obviously first of all, we need to protect web application
from critical. So you need to be aware about
it. That's what are the top 10 cities of labeled for
websites locations provided
by a West.
So he can leave. Companies should adopt this document
and start the process of ensuring that their web applications
minimize these breasts. The first of all, you need to
focus on these top 10 disk using the
top 10 is the most effective for step towards
changing the software development culture within your organization into
one that produces more particular quarter. What are
the top 10? I think
I'm dumb.
Maybe do some top 10 application, security
risks of fersters injection II
broken, authentication, sensitive data,
export XML external entities,
broken Access Control, security Miss
cancellation Nexus, S insecurities civilization using
component with no knowledge of these
are the top 10 leveling valve
applications.
To learn more about it. So Foster's injection. You
can see he had injection flaws like SQL injection or
a lap. Injections are available in applications of
an untrusted date. I signed into an interpreter as
a part of Commander Cody is SQL
injection. Carries into a replication to
gather information from your database, where all the
data store that I can host a leader, can interpret
and executing an enchanted commands in is
applications functions related to a tent acacian and session management. Along with
that has to compromise, password Keys session tokens
and flex part of their users
identities. Temporarily are American Legion
in the web application.
Sofa table fire inside an
application. So I need to provide username and password. So
if a Tigers have a bill to get those
Union password, that would be able to access application, sensitive data
exposure.
Many web applications and APS do not properly protect sensitive data.
So if
I'll take help of week, apis together information.
XML external entities, which is also collect sexy. So,
it happens because of a polygon
figured XML processes evaluate external
entity differences with an XML document.
So I can also insert XML
code inside application and as possible
gather information about
scanning
remote code, execution. Attack means flooding,
a broken Access Control
allowed to
do our offer not properly. Enforced, sanitized
functionality
out of the user's account.
I have you started with two example. If you
have a URL,
And and you are as we
have a parameter name equal to a b c.
So if broken access control on DVDs available
in application, and if I'm able to see the result
of a b c. So if I change a
be seen to be CD, I can I can see the result of
obesity without any Authentication.
So, we just because broken necklace control existed
inside application.
All right. Next to security Miss configuration. Then it
is a very common type of issue an application because
you can
see here insecure default, configuration in complete
Orlando, configuration open cloud storage, Winston cigarettes
today. For Bowser and messages containing using
various techniques.
Default account password error
messages, provided by applications are
showing the sensitive data
can happen.
Cross-site scripting.
No. Access to all the Garden of Eden application, included
and trusted, a tiny web page without proper validation or
escaping. So we can
meet up locations
to gather more information. So, we
can
attack on victims browser with the help of
HTML or JavaScript Woody's.
Insecurities civilization of leads to
remote code execution. So I can
be used to perform attacks and
suddenly play injection. The legislation excetra Nexus using
competence with no Liberties. So components
applications on the library's
Frameworks software, run
with the same privileges application. If I want Little Bill
Company, Dayton experience, for example, you have refused to
extend the library into an application and that libraries
outdated. So I can send that librarian
can access your application can attack on it.
So that's why all if you are, including some
external libraries of framework, inside your application, make
sure they had updated.
And finally insufficient logging in one session
with
incident response or what type of stupid attack systems.
So basically you need to you need
to money to your system. So, I believe you need to
check logs regularly.
If you want, then it is possible
that the attackers can use the same technique to
attack again and again inside your system. So obviously logging
and monitoring is necessary.
You can see here that allowed to take us, to further, to teksystems painting,
persistence with temper, extra can
destroy the extra bodies
rather than internal process.
So these are the top 10 best Bollywood. He's the
first. If you are a weapon Edition
tester or Rochester. You
need to focus on these top 10 rap applications y'all to
risk. If you are testing me website. Yes, you
can use way. It's kind of automated scanning tools available
in their deck Roxy or else you talking about.
You need to focus on these two plants together. If you
want to protect your weather application from XOX.
So, we will perform some men, will Jack techniques in
the next section, but I will show you
an example of Brute Force attack in next video.