Attackers gain unauthorized access to default accounts, read unused pages, exploit unpatched flaws, and read or write unprotected files and directories, etc. by using misconfiguration vulnerabilities. Server misconfiguration can take place at any level of an application attack, including the following: Platform Web server Application server Framework Custom code The following are server configuration problems: Server software flaws Enabling unnecessary services Improper authentication Unpatched security flaws Injection flaws Injection flaws are the vulnerabilities where a foreign agent illegally uses a sub-system. They are the vulnerability holes that can be used to attack applications. It is the most common technique of attacking a database. Injection occurs when user-supplied data is sent to an interpreter as part of a command or query. The attacker's hostile data tricks the interpreter into executing involuntary commands or changing data. Injection flaws include XSS (HTML Injection) and SQL Injection. In SQL injection, malicious SQL queries are injected into user input methods. In command injection, malicious code is injected via a Web application. In LDAP injection, malicious LDAP statements are injected. The following are countermeasures against injection flaws attacks: Avoid accessing external interpreters wherever possible and use library API's. Use prepared statement or stored procedures to overcome the SQL injection attack. Ensure that the Web application runs only with minimum privileges. Validate data while making calls to backend databases. SQL injection attacks SQL injection attacks use a series of malicious SQL queries for direct manipulation of the database. To bypass normal security measures and access the valuable data, an attacker can use a vulnerable Web application. SQL injection attacks are generally executed from the address bar, from within application fields, and via queries and searches. Command injection attacks
Attackers gain unauthorized access to default accounts, read unused pages, exploit unpatched flaws, and read or write unprotected files and directories, etc. by using misconfiguration vulnerabilities. Server misconfiguration can take place at any level of an application attack, including the following: Platform Web server Application server Framework Custom code The following are server configuration problems: Server software flaws Enabling unnecessary services Improper authentication Unpatched security flaws Injection flaws Injection flaws are the vulnerabilities where a foreign agent illegally uses a sub-system. They are the vulnerability holes that can be used to attack applications. It is the most common technique of attacking a database. Injection occurs when user-supplied data is sent to an interpreter as part of a command or query. The attacker's hostile data tricks the interpreter into executing involuntary commands or changing data. Injection flaws include XSS (HTML Injection) and SQL Injection. In SQL injection, malicious SQL queries are injected into user input methods. In command injection, malicious code is injected via a Web application. In LDAP injection, malicious LDAP statements are injected. The following are countermeasures against injection flaws attacks: Avoid accessing external interpreters wherever possible and use library API's. Use prepared statement or stored procedures to overcome the SQL injection attack. Ensure that the Web application runs only with minimum privileges. Validate data while making calls to backend databases. SQL injection attacks SQL injection attacks use a series of malicious SQL queries for direct manipulation of the database. To bypass normal security measures and access the valuable data, an attacker can use a vulnerable Web application. SQL injection attacks are generally executed from the address bar, from within application fields, and via queries and searches. Command injection attacks
Hacking%20Web%20Applications.docx