Q K Data Data Geoff can inject data into a client Gabe can inject data into an (no card) (no card) or device interpreter because a server-side interpreter (e.g. SQL, Validation Validation parameterised interface is not OS commands, Xpath, Server being used, or has not been JavaScript, SMTP) because a implemented correctly, or the strongly typed parameterised data has not been encoded interface is not being used or has correctly for the context, or there not been implemented correctly is no restrictive policy on code or data includes & & Encoding Encoding A 2 3 Authentication Authentication Authentication Authentication You have invented a new attack (no card) James can undertake Muhammad can obtain a user's against Authentication authentication functions (e.g. password or other secrets such as attempt to log in, log in with security questions, by observation stolen credentials, reset the during entry, or from a local password) without the real user cache, or in transit, or by reading ever being aware this has it from some unprotected occurred location, or because it is widely known, or because it never expires, or because the user cannot change her own password
Data Validation & Encoding Q Data Validation & Encoding K Geoff can inject data into a client or device interpreter because a parameterised interface is not being used, or has not been implemented correctly, or the data has not been encoded correctly for the context, or there is no restrictive policy on code or data includes Gabe can inject data into an server-side interpreter (e.g. SQL, OS commands, Xpath, Server JavaScript, SMTP) because a strongly typed parameterised interface is not being used or has not been implemented correctly (no card) (no card) Authentication A Authentication Authentication 2 Authentication 3 You have invented a new attack against Authentication (no card) James can undertake authentication functions (e.g. attempt to log in, log in with stolen credentials, reset the password) without the real user ever being aware this has occurred Muhammad can obtain a user's password or other secrets such as security questions, by observation during entry, or from a local cache, or in transit, or by reading it from some unprotected location, or because it is widely known, or because it never expires, or because the user cannot change her own password
20130918180752%21OWASP-Cornucopia-Ecommerce_Website.docx