Owasp top 10 web application security risks 2017

TABLE OF CONTENTS
• About OWASP
• OWASP Top 10 Application Security Risks–2017
• What changed from 2013 to 2017?
• A1 : 2017-Injection
• A2 : 2017-Broken Authentication
• A3 : 2017-Sensitive Data Exposure
• A4 : 2017-XML External Entities (XXE)
• A5 : 2017-Broken Access Control
• A6 : 2017-Security Misconfiguration
• A7 : 2017-Cross-Site Scripting (XSS)
• A8 : 2017-Insecure Deserialization
• A9 : 2017-Using Components with Known Vulnerabilities
• A10 : 2017-Insufficient Logging & Monitoring
• What’s Next for Developers
• Organizations
• Conclusion

WHY 2017
Basically they started this top 10 project from 2003 and started
delivering the top 10 vulnerabilities of major platforms like mobile
and webapps .
2004 Updates OWASP Top Ten Project
Top 10 2007
Top 10 2010
Top 10 2013
Top 10-2017 Top 10

ABOUT OWASP
The Open Web Application Security Project (OWASP) is an open
community dedicated to enabling organizations to develop, purchase,
and maintain applications and APIs that can be trusted.
Project Sponsorship : Autodesk
Learn more at : https://www.owasp.org.

OWASP TOP 10 APPLICATION
SECURITY RISKS–2017
A1 : 2017-Injection
A2 : 2017-Broken Authentication
A3 : 2017-Sensitive Data Exposure
A4 : 2017-XML External Entities (XXE)
A5 : 2017-Broken Access Control
A6 : 2017-Security Misconfiguration
A7 : 2017-Cross-Site Scripting (XSS)
A8 : 2017-Insecure Deserialization
A9 : 2017-Using Components with Known Vulnerabilities
A10 : 2017-Insufficient Logging & Monitoring

WHAT CHANGED FROM 2013
TO 2017?

A1 : 2017-INJECTION
Injection flaws, such as SQL, NoSQL, OS commands, XML parsers and LDAP
injection, occur when untrusted data is sent to an interpreter as part of a
command or query. The attacker's hostile data can trick the interpreter into
executing unintended commands or accessing data without proper
authorization.
Injection flaws are easy to discover when examining code. Scanners and
fuzzers can help attackers find injection flaws.
Eg: SQL injection : insert some sql queries into the URL or some text
fields which are vulnerable.
Eg : www.sitename.com inurl:php?id= ------ finds the php sites of that domain
www.sitename.com/indexsinglepost.php?postid=34’ ---- check for any changes
appeared
union select 1,version(),3,4,5,6,7,8,9 - - -> tells the version of server

IS THE APPLICATION
VULNERABLE?
An application is vulnerable to attack when:
User-supplied data is not validated, filtered, or sanitized by the
application.
Dynamic queries or non-parameterized calls without contextaware
escaping are used directly in the interpreter.
Hostile data is used within object-relational mapping (ORM) search
parameters to extract additional, sensitive records.
Hostile data is directly used or concatenated, such that the SQL or
command contains both structure and hostile data in dynamic
queries, commands, or stored procedures.

A2 : 2017-BROKEN
AUTHENTICATION
Application functions related to authentication and session
management are often implemented incorrectly, allowing attackers to
compromise passwords, keys, or session tokens, or to exploit other
implementation flaws to assume other users' identities temporarily or
permanently.
Attackers can detect broken authentication using manual means and
exploit them using automated tools with password lists and
dictionary attacks
sessionID : 1gLXXEnpGbaQjUGvjOFdnN2viP3Wqb7DP4b70
Unencrypted connections (Man in the middle attack)
Predictable login credentials

A3 : 2017-SENSITIVE DATA
EXPOSURE
Many web applications and APIs do not properly protect sensitive
data, such as financial, healthcare, and PII. Attackers may steal or
modify such weakly protected data to conduct credit card fraud,
identity theft, or other crimes. Sensitive data may be compromised
without extra protection, such as encryption at rest or in transit, and
requires special precautions when exchanged with the browser.
Bad/no encryption techniques(listening anonymously)
See the SSL certificate provided(HTTPS)
Lot many Bugs which acts as a backdoors

A4 : 2017-XML EXTERNAL
ENTITIES (XXE)
Many older or poorly configured XML processors evaluate external
entity references within XML documents. External entities can be used
to disclose internal files using the file URI handler, internal file
shares, internal port scanning, remote code execution, and denial of
service attacks. Eg : Billion laughs attack

A5 : 2017-BROKEN ACCESS
CONTROL
Restrictions on what authenticated users are allowed to do are often
not properly enforced. Attackers can exploit these flaws to access
unauthorized functionality and/or data, such as access other users'
accounts, view sensitive files, modify other users' data, change access
rights, etc.
Using APPSCAN we can get to know these vulnerability
 Eg: webapp.com/admin_info
 Webapp.com/accfiles?act=1234

A6 : 2017-SECURITY
MISCONFIGURATION
Security misconfiguration is the most commonly seen issue. This is
commonly a result of insecure default configurations, incomplete or
ad hoc configurations, open cloud storage, misconfigured HTTP
headers, and verbose error messages containing sensitive
information. Not only must all operating systems, frameworks,
libraries, and applications be securely configured, but they must be
patched/upgraded in a timely fashion.
Default accounts
Configuring the servers as we need , by changing the default ones
Run an APPSCAN

A7 : 2017-CROSS-SITE
SCRIPTING (XSS)
XSS flaws occur whenever an application includes untrusted data in a
new web page without proper validation or escaping, or updates an
existing web page with user-supplied data using a browser API that
can create HTML or JavaScript. XSS allows attackers to execute scripts
in the victim's browser which can hijack user sessions, deface web
sites, or redirect the user to malicious sites.
<script>alert("hi")</script>
Eg:
http://demo.testfire.net/search.jsp?query=%3Cscript%3Ealert%28%22hi%22%29%3C%2F
script%3E

A8 : 2017-INSECURE
DESERIALIZATION
Insecure deserialization often leads to remote code execution. Even if
deserialization flaws do not result in remote code execution, they can
be used to perform attacks, including replay attacks, injection
attacks, and privilege escalation attacks.
Complicated vulnerability
Eg : JSON and XML files which obviously go through some
serialization and deserialization techniques.

A9 : 2017-USING
COMPONENTS WITH KNOWN
VULNERABILITIES
Components, such as libraries, frameworks, and other software
modules, run with the same privileges as the application. If a
vulnerable component is exploited, such an attack can facilitate
serious data loss or server takeover. Applications and APIs using
components with known vulnerabilities may undermine application
defenses and enable various attacks and impacts.
Heartbleed : a buffer overflow vulnerability in widely used encryption
library SSL
Shellshock : a shell command injection vulnerability in the
ubiquitious bash unix command line
CVE & NVD

A10 : 2017-INSUFFICIENT
LOGGING & MONITORING
Insufficient logging and monitoring, coupled with missing or
ineffective integration with incident response, allows attackers to
further attack systems, maintain persistence, pivot to more systems,
and tamper, extract, or destroy data. Most breach studies show time
to detect a breach is over 200 days, typically detected by external
parties rather than internal processes or monitoring.
Log files --- monitoring (Brute forcing attacks)

WHAT’S NEXT FOR
DEVELOPERS
Application Security Requirements
Standard Security Controls
Secure Development Lifecycle
Application Security Education

ORGANIZATIONS THAT
CONTRIBUTED THEIR
VULNERABILITY DATA TO
SUPPORT THE 2017 UPDATE :

CONCLUSION
The main aim of OWASP top 10 project is is to
raise the awareness among the developers and
the managers about the security needs and
implementations.
“Make it work, make it right, make it fast.” –
Kent Beck
“Fix the cause, not the symptom.” – Steve
Maguire

REFERENCES
https://www.owasp.org/images/7/72/OWASP_Top_10-
2017_%28en%29.pdf.pdf
https://www.youtube.com/watch?v=02mLrFVzIYU&list=PLjo3i9XN49
YLcY9mlW7-Z5nd8XP1Gt9n1
https://www.sytechlabs.com/

Owasp top 10 web application security risks 2017

Owasp top 10 web application security risks 2017

More Related Content

What's hot

Similar to Owasp top 10 web application security risks 2017

Recently uploaded

Owasp top 10 web application security risks 2017