Janko in a Jar

The time has come that I have to work on security at one bigger project. I know the basics but I digged in that much. I will post my notes here.

Web Application (WA) security is a very wide and also vague term. I need to break it down to concrete things — to the specific security threats for web-apps (WA) and then explore one by one.

1. input data related to DB (SQL injections, wrong unexpected data..)
2. input data when related to HTML, JS, VBs..(script injection and all that it can bring)
3. User authentication (password, login security)
4. sessions and cookies (stolen, replayed, hijacked)
5. directory traversal
6. shell escape (injection)
7. DB password hard-coded in web-reachable file
8. XSS
9. CSRF
10. Canonicalization, Unicode

Some of these threats can be eliminated by just concise coding (and being aware of them), other need some special devotion. I will explore them deeper soon.

This entry was posted on Friday, December 14th, 2007 at 5:33 pm and is filed under web-dev.