Dec 4

Written by: host
Monday, December 04, 2006

XSS (Cross-Site Scripting)
Cross-site scripting is a relatively new category of attack. An attacker embeds information in a page that will be presented to other users and cause their browser to take action. Bulletin board-type applications most often exhibit this flaw, and stolen cookies tend to be the most used attack to exploit the vulnerability.

SQL Injection
An attacker is able to embed SQL commands within a command or request presented to the application. Instead of searching for a particular value, for example, an injection may cause the SQL server to return all values in a particular field.

Hidden Form Field Manipulation
Some HTML form elements are sent to the browser in hidden fields that clients can't change. A number of programs and methods tweak these hidden values; applications that trust such values are vulnerable.

Parameter Manipulation
Also called "command execution." Any time a parameter is passed directly from the Web application to a shell application, it may be possible to have arbitrary commands executed directly on the server.

Weak Session Cookies
A class of security flaw that includes any situation where cookies are predictable based on user names or other obvious information. Also refers to cookies that can be easily stolen from one application session and used elsewhere.

HTML Comments
Developers often add comments in HTML during testing and debugging, which may include such information as login information, backend server configuration, and so on. Unless these comments are suppressed or stripped out, they can be culled by would-be attackers.

Tags: