Skip to content
Search

Internet security

lastmod 2025-02-11created 2021-02-069 edits

Internet security refers to preventing unauthorized access to computer systems or threats through the Internet. Most protection comes through data encryption and passwords. Data encryption refers to the process of translating data in an unintelligible form without a separate translation device. A password is a secret word or phrase that grants a user access to a particular program or system.

Basic for developers

SQL Injection
A technique that attacks by inserting malicious SQL into a request
  • A simple but very powerful attack
  • These days most libraries and frameworks block it, but always be careful
  • Error based SQL Injection
    • A method that deliberately triggers errors to find out information about the DB
    • Be careful not to expose error messages
  • Blind SQL Injection
    • An attack method that infers whether the desired information exists by looking at the true/false result of a query
    • This can reveal database, table, and column names
  • Union SQL Injection
    • An attack method that obtains information using the union command
XSS
An attack that inserts malicious JavaScript into a web page
  • Filtering must be done well
  • Stored XSS
    • The attack method usually introduced when people talk about XSS
    • An attack that puts JavaScript code into the DB so that it runs when loaded
    • Block script execution in the browser and filter when storing
  • Reflected XSS
    • An attack method that exposes input directly to the browser
    • When the URL Query has something like redirectUrl, JavaScript can be put there
    • Must be blocked because malicious links can be distributed to others
  • DOM Based XSS
    • A method that puts a malicious script into the DOM
    • Can be put into things like the src of an img tag
CSRF Attack
An attack in which the attacker uses a service user to send requests
Can be blocked with Referer Check, CSRF Token, CAPTCHA
Command Injection
An attack that exploits logic that runs a shell
  • Very critical, as it is practically the same as having system privileges taken over
  • It is best not to use system functions that run shell commands; if you must, filter sensitive characters such as |, &, ;, >, <
File Upload Attack
If a file containing code capable of a WebShell is uploaded and a hacker can access it via URL, the effect is the same as Command Injection
  • It is good to check the extension and file type and store only allowed types
  • Store uploaded files with randomized names and extensions so that hackers cannot find them
  • It is good to block uploads that contain special characters (prevents Null byte Injection)
JavaScript Injection
An attack that injects JavaScript in the browser
  • If sensitive data has been put on the Client-Side, it can be stolen through this attack
  • Never put sensitive data in Plain form on the client
  • If data validation is needed, it must be handled on the server
DDoS
An attack that uses distributed systems to send abnormally large amounts of traffic to a server and paralyze it
  • Simple, but the hardest attack to block
Dictionary Attack
An attack that tries a large number of strings registered in a database in advance as passwords
  • Prevent simple words from being registered as passwords
  • Introduce an Account Lockout Policy
  • Introduce 2-factor authentication such as OTP
Rainbow Table
A table that stores all the strings produced by hashing plaintexts with a hash function
  • Mainly used to recover the original passwords after stealing account data
  • Use Salt
  • Key Stretching
  • Use cryptographic algorithms such as PBKDF2, Bcrypt

Categories

See also

Favorite site

author Zer0 sitemap