OWASP Top 10 Vulerabilities "A1:2017-Injection"

Top 10 Vulnerabilities in web applications- OWASP

Introduction

OWASP (Open web application security project) community helps organizations cultivate secure applications. They come up with standards, freeware tools and conferences that help organizations as well as researchers. Here we see about A1-Injection which is Top 1 on OWASP along with the risk, impact, and Solutions. 

Will discuss more about OWASP top10 vulnerabilities along with few examples. This will to understand these Vulnerabilites in the web applications.

What more?? Let us start!

1. Injection

Introduction

“Injection attacks occur when the user is able to input untrusted data tricking the application/system to execute unintended commands.”

Injections can be – SQL queries, PHP queries, LDAP queries and OS commands. Before we jump to the examples: Let us think about few things:

Q: What to inject?

A: Queries, OS commands, codes and URL argument manipulations.

Q: Where to inject?

A: Wherever a user input is required or use can modify data. It can be a text box, username/password field, feedback fields, comment field, URL etc.

Q: Why to inject?

A: To check if the application is vulnerable.

Example:

Figure 1 : Normal input

In the above 2 textboxes with first name and last name. Once the input is entered and GO is clicked, the input is displayed on the screen. 

Figure 2: HTML Tags inserted

Now let us add some HTML tags as above and see what happens.

The HTML tags are processed and we have the output displayed. This ensures that the user’s input has not been validated and just assumes to be trusted and processed. This is an example for HTML injection. Similarly, PHP injection, OS command injection, iFrame injection, LDAP injection etc. can be injected. 

Solution:

·         Input sanitization: Implement whitelisting approach at server side for what all can be   accepted.

·         Use of safe API’s and parametrized queries.