Geoff can inject data into a client Gabe can inject data into an (no card) (no card) or device side interpreter because server-side interpreter (e.g. SQL, a parameterised interface is not OS commands, Xpath, Server being used, or has not been JavaScript, SMTP) because a implemented correctly, or the strongly typed parameterised data has not been encoded interface is not being used or has correctly for the context, or there not been implemented correctly is no restrictive policy on code or data includes A 2 3 Authentication Authentication Authentication Authentication You have invented a new attack (no card) James can undertake Muhammad can obtain a user's against Authentication authentication functions without password or other secrets such as the real user ever being aware this security questions, by observation has occurred (e.g. attempt to log during entry, or from a local in, log in with stolen credentials, cache, or in transit, or by reading reset the password) it from some unprotected location, or because it is widely known, or because it never expires, or because the user cannot change her own password Read more about this topic in OWASP’s free Authentication Sheet 4 5 6 7
Geoff can inject data into a client or device side interpreter because a parameterised interface is not being used, or has not been implemented correctly, or the data has not been encoded correctly for the context, or there is no restrictive policy on code or data includes Gabe can inject data into an server-side interpreter (e.g. SQL, OS commands, Xpath, Server JavaScript, SMTP) because a strongly typed parameterised interface is not being used or has not been implemented correctly (no card) (no card) Authentication A Authentication Authentication 2 Authentication 3 You have invented a new attack against Authentication (no card) James can undertake authentication functions without the real user ever being aware this has occurred (e.g. attempt to log in, log in with stolen credentials, reset the password) Muhammad can obtain a user's password or other secrets such as security questions, by observation during entry, or from a local cache, or in transit, or by reading it from some unprotected location, or because it is widely known, or because it never expires, or because the user cannot change her own password Read more about this topic in OWASP’s free Authentication Sheet 4 5 6 7
20160629145452%21OWASP-Cornucopia-Ecommerce_Website.docx