Skip to main content

Common Web Vulnerabilities

In this chapter, we'll delve into the most common web vulnerabilities that pose significant threats to web security. Understanding these vulnerabilities is crucial for developers to implement effective security measures and create robust web applications.

1. SQL Injection​

SQL injection is one of the oldest and most prevalent web vulnerabilities. It occurs when user input is not properly sanitized before being used in database queries.

How SQL Injection Works​

An attacker injects malicious SQL code into user inputs, bypassing the application's intended functionality and potentially gaining unauthorized access to the database.

Example​

-- Vulnerable query
SELECT * FROM users WHERE username = 'user' AND password = 'pass';

In the case of a SQL injection, an attacker could manipulate the query by entering a specially crafted input:

' OR '1'='1'; --

This would turn the original query into:

SELECT * FROM users WHERE username = '' OR '1'='1'; --' AND password = '';

This query always returns true, allowing the attacker to bypass authentication.

Mitigation​

  • Parameterized Queries: Use prepared statements with bound parameters, which separates SQL code from user input, preventing injections.

Example in Python (with SQLAlchemy):

# Safe query with parameterization
connection.execute("SELECT * FROM users WHERE username = :username AND password = :password", 
                   {"username": user_input, "password": pass_input})
  • Input Validation: Ensure that user input is validated and sanitized.
  • Use ORM: Object-Relational Mappers (ORMs) like Django ORM or SQLAlchemy abstract away direct SQL queries, reducing the risk of SQL injection.

2. Cross-Site Scripting (XSS)​

Cross-Site Scripting (XSS) is a vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. It can lead to account hijacking, data theft, and defacement of websites.

How XSS Works​

XSS attacks typically occur when an application includes user-supplied data in web pages without proper validation or escaping. This allows the attacker to execute JavaScript code in the context of another user's session.

Example​

<!-- Vulnerable HTML code -->
<p>Your comment: <script>alert('XSS');</script></p>

Mitigation​

  • Input Sanitization: Strip out or escape special characters such as < and > from user inputs.
  • Output Encoding: Encode user-supplied content before rendering it in HTML, JavaScript, or CSS.
  • Use CSP (Content Security Policy): A CSP helps prevent XSS attacks by controlling what resources can be loaded on the web page.

3. Cross-Site Request Forgery (CSRF)​

CSRF is an attack that forces a logged-in user to unknowingly execute unwanted actions on a web application in which they are authenticated.

How CSRF Works​

Attackers craft malicious links or forms that, when visited or submitted by a user, can trigger actions like transferring funds or changing account details.

Example​

<!-- Malicious form that triggers a fund transfer -->
<form action="https://bank.com/transfer" method="POST">
    <input type="hidden" name="account" value="attacker_account">
    <input type="hidden" name="amount" value="1000">
    <input type="submit" value="Click me!">
</form>

Mitigation​

  • CSRF Tokens: Include a random, unique token in forms and ensure that it matches on the server before processing any sensitive requests.
  • SameSite Cookie Attribute: Use the SameSite attribute for cookies to prevent them from being sent on cross-origin requests.
  • Double-Submit Cookie Pattern: Use a technique where a CSRF token is stored both as a cookie and in a hidden form field.

4. File Upload Vulnerabilities​

Allowing users to upload files can be a significant security risk if not properly handled. Attackers could upload malicious files like scripts or executables that could compromise your server.

How File Upload Vulnerabilities Work​

Malicious files, such as .php or .exe, can be uploaded and executed on the server if proper validation and handling are not implemented.

Mitigation​

  • File Type Validation: Restrict file uploads to safe types such as images or documents by checking MIME types.
  • File Size Limits: Set maximum file size limits to prevent resource exhaustion.
  • Store Files Outside Webroot: Store uploaded files in a directory outside the web-accessible folder and serve them securely.
  • Sanitize File Names: Strip or encode special characters in filenames and rename uploaded files with random names.

Conclusion​

Understanding and mitigating these common web vulnerabilities are essential skills for every web developer. By implementing best practices such as input validation, proper encoding, CSRF protection, and secure file handling, you can greatly reduce the attack surface of your web applications and protect both your users and systems.

The next steps include incorporating more advanced security measures, performing regular security audits, and staying up-to-date with the latest security trends and vulnerabilities.