Hey everybody welcome to the next video.
In this video where we talk about the office top 10 and in the next few videos after this we're gonna
be going over different attacks and vulnerabilities on a web application.
Now a wasp or open web application security project is a type of project that brings together Common
Application Security for web apps vulnerabilities and packages of vulnerabilities.
So what I want to do is take a quick look at the top 10 that they have for 2013.
There's a new one coming up for 2017 that hasn't been officially submitted yet.
However we're gonna be looking at the last official one for 2017 or for 2013.
But what I want to note quickly about the top 10 is it's not the final giant list of every possible
issue that you're going to find on a web application.
There's gonna be stuff that's not on here and that's just the way it goes.
But it's a good thing to know off the top of your head because a lot of red team and security and apps
like job interviews will end up bringing this up in some way shape or form or add some requirement on
a job description.
So because of that on top of the knowledge that it brings on its own it's a good thing to know.
So the first way we're going to take a look at is injection now injection can be for a lot of things
such as sequel injection or ex AML injection.
So it really just depends we're going to be going over sequel injection in this particular course.
But if you want to posit go ahead and pause here and read through this the link for the last 10 pages
while this one in particular right here is actually above the video so you can click on any of these
and read it thoroughly more if you want.
And it goes into here where you can each each lost has its own page about the prevention cheat sheet
so you can get a better idea of how it works.
So there's types of injections such as equal injection X AML injection etc. Then the next one is broken
authentication and session management.
Now this is a pretty wide topic because this can go everything from exposing session ideas in you are
also you can see that here at the bottom not timing out sessions session ideas aren't rotated.
There's just a lot of scenarios here and there's it's a very big and broad section.
Next thing we had this cross site scripting.
So this is more or less injecting a similar javascript into an application in different ways such as
through reflected stored and Dom based which we're gonna we're going to go over in our own video so
for number four we have insecure direct object references or IDE or which is mainly when in this example
it's saying the account is equal to and would normally be your account you change that to somebody else's
maybe you can leverage that a little bit because in the in the code here it looks like it's not sanitizing
the user input so it's taking it directly as is and using that value and grabbing that parameter so
the next step is number five as security is a security risk configurations.
Now this can be almost anything.
It's a very very I would be willing to say that this is probably the widest topic because there's so
many different systems out there and so many different configurations that one might be vulnerable to
something one might not be.
One might be vulnerable only if these five or 10 different things are configured a specific way.
So there's just way too much to go on here.
But any security mis configuration is number five.
So number six is sensitive data exposure.
Now again this can be anything from not using SSL or tell us to secure your connection using unsalted
hashes.
So everyone's passwords is just directly hashed out just pretty wide topic as well.
But this can in a general sense it's mainly referring to for example year old old cryptographic algorithms
that are being used browser security directives or headers are missing from the server just a lot of
different things.
Then the next thing we're going to be looking at is missing function level access control.
So this is something also called as the authenticated and an authenticated page.
So for example an admin might have an admin log in that BHP under the admin page but the admin that
BHP file that holds all the admin privileges and actually you can you know end users or whatever might
not actually have authentication set up on it.
So you might be able to just go directly to the page in that load and it will load up.
So there are there are tools to help with this such as door buster where you can find out what's in
a directory within reason for reporting it but there's no tool to directly look for this particular
issue because the tool wouldn't know whether it's supposed to be there or not.
So it's kind of something you're going to have to learn to do on your own CSR F which is cross that
request forgery.
What I want to do is take just a second here and have you guys give you a little bit of a homework assignment
to do with this.
Now CSR is not something we've gone over or will go over in this particular course.
But what I want you to do is look up CSR if after you finished the exploitation module so you've gone
through the web application all of the web application videos I want you to go through and try to do
and try to learn CSR.
Because we're gonna be using something called DV W.A. for damn vulnerable Web application and there
is a CSR f area in that web app.
So when you install that and get it running I want you guys to go ahead and check out and see if you
can do CSR and understand what it is.
So I'll leave a link in the description above the video that will give you a quick tutorial on how to
do CSR act and what it is.
The next one and using components with known vulnerabilities should be self explanatory so such as using
vulnerable spring maybe you're using a vulnerable plug in on a wordpress site.
So there are just a lot of options here and it's not just related to web apps.
There's other software that has plugins added to it as well.
Spring isn't always used for web apps as an example.
So there's a lot of options here.
So anything with known vulnerabilities or any known vulnerability at all with components on a main application
is using and then we have unbounded redirects or forwards.
So this is something where a user or a web application is using this redirect normally for web applications.
Normal flow but it doesn't sanitize it it doesn't.
It's letting a user access and run this particular redirect function without having without the web
that haven't been the one doing it.
And that can lead to more complicated phishing things as an example the user might trust example dot
com because you're giving them the link and most users will stop reading right about here when they
get to the first the first page or the first part of you are out and then they're actually going end
up on evil dot com instead of example dot com or they expected to be.
So that's pretty important when it comes to a phishing attempt or anything from a red team's perspective
or an attacker's perspective from that matter when you're trying to trick a user to getting to a page
that you want to be at so that's the OS top 10 like it's a good thing to know it's got a lot of good
information feel free to browse through this and read a bit more into each section.
Most of these were going to hit with the course itself but it's always good to broaden that that knowledge
just a little bit more because I can't cover everything in the videos so there's always going to be
some self-learning.