diff --git a/OWASP test - Sloetjes.md b/OWASP test - Sloetjes.md index 9614ca4..5d99fd1 100644 --- a/OWASP test - Sloetjes.md +++ b/OWASP test - Sloetjes.md @@ -86,23 +86,62 @@ > Trust in this context depends on the integrity of the individual and the safeguards in place. A database administrator should ideally not have the ability to view sensitive customer data in plaintext. Using proper encryption and access control measures can prevent unauthorized access, including by database administrators. * If the database administrator will be immediately executed by firing squad if private customer data ever leaks, then can you trust them with the private customer data? -> +> It doesn't alter the best practices in data security. It remains that sensitive data should be encrypted, and access should be controlled and monitored, regardless of potential consequences. Trust should not be based on fear but on effective security measures. + * If *you* will be immediately executed by firing squad if private customer data ever leaks, then can anyone ever trust *you* with the private customer data? +> Trust should not be established through severe consequences or personal liability alone. Instead, it should be based on the implementation of robust security measures, regular audits, training, and a culture of privacy and security. + * Can the *customer* ever be trusted with their own private customer data? +> In general, customers should have control over their own data, including the right to access it. However, they may not always follow best practices for data security, such as using strong passwords or safeguarding sensitive information. Therefore, systems should be designed to encourage and facilitate good security practices. + * Can *anyone* ever be trusted with private customer data? +> Trust with private customer data should be established through robust security measures, ethical data handling practices, and transparency. These measures include data encryption, minimal data collection, secure storage, and strict access controls. It's not about whether anyone can be trusted, but rather about how systems and practices are designed to protect the data. ==A03== * What is little bobby tables? +> "Little Bobby Tables" refers to a humorous example from the webcomic "xkcd". In one strip, a character named Mrs. Roberts tells her son's school that she named her son Robert'); DROP TABLE Students;-- to demonstrate the dangers of not sanitizing user input in a SQL query, leading to SQL injection. + * Describe the most insecure possible way to use an ORM to look up data in a table, using search parameters provided by the user. +> The most insecure way to use an ORM would be to directly concatenate user-supplied input into a query without any validation or sanitization. This approach makes the application susceptible to SQL Injection attacks. + * What is log4shell? What was the original intent of the exploited feature? Describe the exploit. +> Log4Shell is a severe vulnerability (CVE-2021-44228) in the Log4j logging library, a widely-used Java-based logging utility. The vulnerability allows for arbitrary code execution through a flaw in the way Log4j handles log messages. +> The original intent of the exploited feature was to provide a way to perform logging in a variety of contexts, and to provide lookup functionality to include additional information in log messages. +> The exploit involves using this lookup functionality in an unintended way. Log4j is able to interpret log messages that contain references to external resources, specifically LDAP servers. A specially crafted log message can force Log4j to load malicious code from an external LDAP server controlled by the attacker. This code is then executed within the context of the running Java application, potentially leading to a full system compromise. +> This vulnerability became infamous due to its severity, the simplicity of exploitation, and the widespread use of the affected library. It was rated with a CVSS score of 10, indicating the highest level of severity. + * Describe a technique to debug a SQL injection payload, if the statement's success or failure, and database output, cannot be seen by the attacker. +> One common technique for blind SQL injection is to use a method known as time-based SQL injection. Here, the attacker can send SQL queries that cause the database to wait for a specified amount of time before responding. By measuring the response times, an attacker can infer if the SQL query was successful. + * Describe how to prevent that technique. +> To prevent time-based SQL injection, we should follow the general prevention techniques for SQL Injection. This includes using parameterized queries, ORM, or stored procedures to interact with the database and avoid the inclusion of user-supplied input directly into SQL queries. Also, limit the privileges of database accounts used by web applications. + * Why is it important to have an administrative front-end to manage the production database, as opposed to using the SQL console directly? +> Having an administrative front-end allows for a more controlled and secure way to interact with the database. It can provide user-friendly interfaces, limit the execution of potentially harmful commands, log activities for audit purposes, and manage access controls. + * How could you tell if a XPath query you found is vulnerable to an injection attack? +> XPath Injection vulnerabilities typically occur when a web site uses user-supplied information to construct an XPath query for XML data. If you can provide input that changes the structure of the query itself, or see that user input is inserted into queries without being sanitized, then the XPath query is likely vulnerable to an injection attack. + * What is a HTML entity? +> An HTML entity is a piece of text ("string") that begins with an ampersand (&) and ends with a semicolon (;). Entities are used to represent reserved characters in HTML that can't be used as they may be confused with HTML markup. + * Describe an XSS vulnerability, and the most common way to defend against it. +> Cross-Site Scripting (XSS) vulnerabilities occur when an application includes untrusted data in a new web page without proper validation or escaping, or updates an existing web page with user-supplied data using a browser API that can create HTML or JavaScript. The most common way to defend against XSS is by using context-sensitive output encoding/escaping techniques when inserting user-supplied content into the page. + * Why is a left angle bracket (`<`) important in that context? +> The left angle bracket (<) signifies the start of a tag in HTML. If an attacker can inject a string containing a left angle bracket, they might be able to start a new HTML or script tag, leading to a potential XSS attack. + * What is UTF-7? +> UTF-7 is a way of encoding Unicode characters using only a subset of ASCII characters. It was created for use in email systems, which did not originally support non-ASCII characters. + * Describe how to use UTF-7 to output a left angle bracket, without using a left angle bracket in your solution. -* List three things to look for in an input sanitizer to avoid XSS problems. \ No newline at end of file +> In UTF-7, the left angle bracket (<) can be represented as "+ADw-". Note that this can contribute to XSS vulnerabilities if a web application's content-type can be changed or the charset is not specified and the browser interprets the charset as UTF-7. + +* List three things to look for in an input sanitizer to avoid XSS problems. +> Input sanitizers should: + + + > Be context-aware: Different contexts (like HTML, URLs, CSS, or JavaScript) have different rules about what characters are dangerous. + > Encode or remove special characters: Characters like <, >, ", ', and & often need to be encoded depending on context. + > Be regularly updated and maintained: New attack techniques are discovered regularly, and a good sanitizer library will keep up with these techniques. \ No newline at end of file