diff --git a/README.md b/README.md index 13c3f74..d97662d 100644 --- a/README.md +++ b/README.md @@ -50,7 +50,7 @@ S.No. | Topic **29** | [Vulnerable Code Snippet - 17](/resources/vulnerable-code-17.md) **30** | [Vulnerable Code Snippet - 18](/resources/vulnerable-code-18.md) **31** | [Vulnerable Code Snippet - 19](/resources/vulnerable-code-19.md) -**32** | [Account Takeovers Methodogoly](/resources/account-takeovers.md) +**32** | [Account Takeover Methodology](/resources/account-takeovers-methodology.md) **33** | [Vulnerable Code Snippet - 20](/resources/vulnerable-code-20.md) **34** | [Vulnerable Code Snippet - 21](/resources/vulnerable-code-21.md) **35** | [Vulnerable Code Snippet - 22](/resources/vulnerable-code-22.md) @@ -63,7 +63,59 @@ S.No. | Topic **42** | [Vulnerable Code Snippet - 29](/resources/vulnerable-code-29.md) **43** | [Vulnerable Code Snippet - 30](/resources/vulnerable-code-30.md) **44** | [Vulnerable Code Snippet - 31](/resources/vulnerable-code-31.md) - +**45** | [Vulnerable Code Snippet - 32](/resources/vulnerable-code-32.md) +**46** | [Vulnerable Code Snippet - 33](/resources/vulnerable-code-33.md) +**47** | [Vulnerable Code Snippet - 34](/resources/vulnerable-code-34.md) +**48** | [Vulnerable Code Snippet - 35](/resources/vulnerable-code-35.md) +**49** | [Vulnerable Code Snippet - 36](/resources/vulnerable-code-36.md) +**50** | [Vulnerable Code Snippet - 37](/resources/vulnerable-code-37.md) +**51** | [Vulnerable Code Snippet - 38](/resources/vulnerable-code-38.md) +**52** | [Vulnerable Code Snippet - 39](/resources/vulnerable-code-39.md) +**53** | [Vulnerable Code Snippet - 40](/resources/vulnerable-code-40.md) +**54** | [Vulnerable Code Snippet - 41](/resources/vulnerable-code-41.md) +**55** | [Vulnerable Code Snippet - 42](/resources/vulnerable-code-42.md) +**56** | [Vulnerable Code Snippet - 43](/resources/vulnerable-code-43.md) +**57** | [Vulnerable Code Snippet - 44](/resources/vulnerable-code-44.md) +**58** | [Vulnerable Code Snippet - 45](/resources/vulnerable-code-45.md) +**59** | [Ruby ERB SSTI](/resources/ruby-erb-ssti.md) +**60** | [Introduction to CWE](/resources/intro-to-cwe.md) +**61** | [CWE-787: Out-of-bounds Write](/resources/cwe-787.md) +**62** | [Vulnerable Code Snippet - 46](/resources/vulnerable-code-46.md) +**63** | [CWE-20: Improper Input Validation](/resources/cwe-20.md) +**64** | [Vulnerabilities in Cookie Based Authentication](/resources/vulnerabilities-in-cookies.md) +**65** | [How do I get Started in Cyber Security? — My Perspective & Learning Path!](/resources/getting-into-cybersecurity.md) +**66** | [Scope Based Recon Methodology: Exploring Tactics for Smart Recon](/resources/scope-based-recon.md) +**67** | [MFA Bypass Techniques](/resources/mfa-bypass.md) +**68** | [Vulnerable Code Snippet - 47](/resources/vulnerable-code-47.md) +**69** | [Vulnerable Code Snippet - 48](/resources/vulnerable-code-48.md) +**70** | [Vulnerable Code Snippet - 49](/resources/vulnerable-code-49.md) +**71** | [Vulnerable Code Snippet - 50](/resources/vulnerable-code-50.md) +**72** | [Vulnerable Code Snippet - 51](/resources/vulnerable-code-51.md) +**73** | [Vulnerable Code Snippet - 52](/resources/vulnerable-code-52.md) +**74** | [Vulnerable Code Snippet - 53](/resources/vulnerable-code-53.md) +**75** | [Vulnerable Code Snippet - 54](/resources/vulnerable-code-54.md) +**76** | [Vulnerable Code Snippet - 55](/resources/vulnerable-code-55.md) +**77** | [Vulnerable Code Snippet - 56](/resources/vulnerable-code-56.md) +**78** | [Vulnerable Code Snippet - 57](/resources/vulnerable-code-57.md) +**79** | [Vulnerable Code Snippet - 58](/resources/vulnerable-code-58.md) +**80** | [Vulnerable Code Snippet - 59](/resources/vulnerable-code-59.md) +**81** | [Vulnerable Code Snippet - 60](/resources/vulnerable-code-60.md) +**82** | [Vulnerable Code Snippet - 61](/resources/vulnerable-code-61.md) +**83** | [Vulnerable Code Snippet - 62](/resources/vulnerable-code-62.md) +**84** | [Vulnerable Code Snippet - 63](/resources/vulnerable-code-63.md) +**85** | [Vulnerable Code Snippet - 64](/resources/vulnerable-code-64.md) +**86** | [Vulnerable Code Snippet - 65](/resources/vulnerable-code-65.md) +**87** | [CWE-200: Exposure of Sensitive Information to an Unauthorized Actor](/resources/cwe-200.md) +**88** | [CWE-732: Incorrect Permission Assignment for Critical Resource](/resources/cwe-732.md) +**89** | [CWE-522: Insufficiently Protected Credentials](/resources/cwe-522.md) +**90** | [CWE-918: Server-Side Request Forgery (SSRF)](/resources/cwe-918) +**91** | [CWE-611: Improper Restriction of XML External Entity Reference](/resources/cwe-611.md) +**92** | [CWE-476: NULL Pointer Dereference](/resources/cwe-476.md) +**93** | [CWE-276: Incorrect Default Permissions](/resources/cwe-276.md) +**94** | [CWE-862: Missing Authorization](/resources/cwe-862.md) +**95** | [CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer](/resources/cwe-119.md) +**96** | [CWE-798: Use of Hard-coded Credentials](/resources/cwe-798.md) +**97** | [CWE-287: Improper Authentication](/resources/cwe-287.md) # SecurityExplained NewsLetter @@ -76,10 +128,42 @@ S.No. | Topic **4** | [Issue-4](https://www.getrevue.co/profile/harshbothra_/issues/securityexplained-issue-4-990787) **5** | [Issue-5](https://t.co/MIS3cFYYtj) **6** | [Issue-6](https://www.getrevue.co/profile/harshbothra_/issues/securityexplained-issue-6-1014382) +**7** | [Issue-7](https://www.getrevue.co/profile/harshbothra_/issues/securityexplained-issue-7-1026847) +**8** | [Issue-8](https://www.getrevue.co/profile/harshbothra_/issues/securityexplained-issue-8-1038241) +**9** | [Issue-9](https://www.getrevue.co/profile/harshbothra_/issues/securityexplained-issue-9-1049767) +**10** | [Issue-10](https://www.getrevue.co/profile/harshbothra_/issues/securityexplained-issue-10-1061802) +**11** | [Issue-11](https://www.getrevue.co/profile/harshbothra_/issues/securityexplained-issue-11-1073189) +**12** | [Issue-12](https://www.getrevue.co/profile/harshbothra_/issues/securityexplained-issue-12-1084203) +**13** | [Issue-13](https://www.getrevue.co/profile/harshbothra_/issues/securityexplained-issue-13-1095142) +**14** | [Issue-14](https://www.getrevue.co/profile/harshbothra_/issues/securityexplained-issue-14-1106987) + +# AskMeAnything -# Guest Resources +___ +S.No. | Topic +--- | --- +**1** | [AMA-1: AMA with Harsh Bothra](https://twitter.com/harshbothra_/status/1497233820336418816) +**2** | [AMA-2: AMA with Six2dez](https://twitter.com/harshbothra_/status/1499731408868179972) +**3** | [AMA-3: AMA with Brumens](https://twitter.com/harshbothra_/status/1511327809733480451) +# Threads ___ S.No. | Topic --- | --- -**1** | [<>](/guest-resources/<>.md) +**1** | [7 Hacking Books you must read](https://twitter.com/harshbothra_/status/1499346357227642886) +**2** | [4 Subdomain Enumeration Tools you must have in your Arsenal 💻](https://twitter.com/harshbothra_/status/1500101328978079744) +**3** | [6 Burp Extensions to Check for Access Control & Privilege Escalation Issues](https://twitter.com/harshbothra_/status/1500848764948389889) +**4** | [5 Powerful Web Fuzzing & Content Discovery Tools You Must Know](https://twitter.com/harshbothra_/status/1501928368521945090) +**5** | [17 Search Engines every Security Professional Must Know](https://twitter.com/harshbothra_/status/1503332626580471808) +**6** | [7 Cyber Security Conferences Channel You Must Follow](https://twitter.com/harshbothra_/status/1505869341748723714) +**7** | [9 Free Practice Labs to Master Cross-Site Scripting](https://twitter.com/harshbothra_/status/1508406052663934979) +**8** | [11 MindMaps I have created that you may find useful!](https://twitter.com/harshbothra_/status/1509168580071329792) +**9** | [14 Payload Repositories to find all the required Payloads & Attack Vectors](https://twitter.com/harshbothra_/status/1509870706347032579) + +# MindMaps +S.No. | Topic +--- | --- +**1** | [Account Takeover Techniques](https://www.xmind.net/m/M3WEqG/) +**2** | [CWE TOP 10 (2021)](https://www.xmind.net/m/icrqti) + + diff --git a/media/code-32.jpg b/media/code-32.jpg new file mode 100644 index 0000000..9467c2a Binary files /dev/null and b/media/code-32.jpg differ diff --git a/media/code-33.jpg b/media/code-33.jpg new file mode 100644 index 0000000..37bca84 Binary files /dev/null and b/media/code-33.jpg differ diff --git a/media/code-34.jpg b/media/code-34.jpg new file mode 100644 index 0000000..fee722c Binary files /dev/null and b/media/code-34.jpg differ diff --git a/media/code-35.jpg b/media/code-35.jpg new file mode 100644 index 0000000..c04c7e9 Binary files /dev/null and b/media/code-35.jpg differ diff --git a/media/code-36.jpg b/media/code-36.jpg new file mode 100644 index 0000000..e13f2ed Binary files /dev/null and b/media/code-36.jpg differ diff --git a/media/code-37.jpg b/media/code-37.jpg new file mode 100644 index 0000000..bdcaa43 Binary files /dev/null and b/media/code-37.jpg differ diff --git a/media/code-38.jpg b/media/code-38.jpg new file mode 100644 index 0000000..d80390f Binary files /dev/null and b/media/code-38.jpg differ diff --git a/media/code-39.jpg b/media/code-39.jpg new file mode 100644 index 0000000..e48ef1f Binary files /dev/null and b/media/code-39.jpg differ diff --git a/media/code-40.jpg b/media/code-40.jpg new file mode 100644 index 0000000..9fd7521 Binary files /dev/null and b/media/code-40.jpg differ diff --git a/media/code-41.jpg b/media/code-41.jpg new file mode 100644 index 0000000..5fe90f3 Binary files /dev/null and b/media/code-41.jpg differ diff --git a/media/code-42.jpg b/media/code-42.jpg new file mode 100644 index 0000000..6b2a8b0 Binary files /dev/null and b/media/code-42.jpg differ diff --git a/media/code-43.jpg b/media/code-43.jpg new file mode 100644 index 0000000..273349a Binary files /dev/null and b/media/code-43.jpg differ diff --git a/media/code-44.jpg b/media/code-44.jpg new file mode 100644 index 0000000..4deb851 Binary files /dev/null and b/media/code-44.jpg differ diff --git a/media/code-45.jpg b/media/code-45.jpg new file mode 100644 index 0000000..12baa51 Binary files /dev/null and b/media/code-45.jpg differ diff --git a/media/code-46.jpg b/media/code-46.jpg new file mode 100644 index 0000000..8da62ac Binary files /dev/null and b/media/code-46.jpg differ diff --git a/media/code-47.jpg b/media/code-47.jpg new file mode 100644 index 0000000..f33b7ad Binary files /dev/null and b/media/code-47.jpg differ diff --git a/media/code-48.jpg b/media/code-48.jpg new file mode 100644 index 0000000..1dd0721 Binary files /dev/null and b/media/code-48.jpg differ diff --git a/media/code-49.png b/media/code-49.png new file mode 100644 index 0000000..801ade1 Binary files /dev/null and b/media/code-49.png differ diff --git a/media/code-50.png b/media/code-50.png new file mode 100644 index 0000000..3071b56 Binary files /dev/null and b/media/code-50.png differ diff --git a/media/code-51.png b/media/code-51.png new file mode 100644 index 0000000..97aa38e Binary files /dev/null and b/media/code-51.png differ diff --git a/media/code-52.png b/media/code-52.png new file mode 100644 index 0000000..cb696fb Binary files /dev/null and b/media/code-52.png differ diff --git a/media/code-53.png b/media/code-53.png new file mode 100644 index 0000000..9baae05 Binary files /dev/null and b/media/code-53.png differ diff --git a/media/code-54.png b/media/code-54.png new file mode 100644 index 0000000..46591b6 Binary files /dev/null and b/media/code-54.png differ diff --git a/media/code-55.png b/media/code-55.png new file mode 100644 index 0000000..d563214 Binary files /dev/null and b/media/code-55.png differ diff --git a/media/code-56.png b/media/code-56.png new file mode 100644 index 0000000..1eca76d Binary files /dev/null and b/media/code-56.png differ diff --git a/media/code-57.png b/media/code-57.png new file mode 100644 index 0000000..9fde832 Binary files /dev/null and b/media/code-57.png differ diff --git a/media/code-58.png b/media/code-58.png new file mode 100644 index 0000000..6ebdf4f Binary files /dev/null and b/media/code-58.png differ diff --git a/media/code-59.png b/media/code-59.png new file mode 100644 index 0000000..6ef6c9a Binary files /dev/null and b/media/code-59.png differ diff --git a/media/code-60.png b/media/code-60.png new file mode 100644 index 0000000..ff8df46 Binary files /dev/null and b/media/code-60.png differ diff --git a/media/code-61.png b/media/code-61.png new file mode 100644 index 0000000..5d6e765 Binary files /dev/null and b/media/code-61.png differ diff --git a/media/code-62.png b/media/code-62.png new file mode 100644 index 0000000..488685b Binary files /dev/null and b/media/code-62.png differ diff --git a/media/code-63.png b/media/code-63.png new file mode 100644 index 0000000..c785143 Binary files /dev/null and b/media/code-63.png differ diff --git a/media/code-64.png b/media/code-64.png new file mode 100644 index 0000000..9677563 Binary files /dev/null and b/media/code-64.png differ diff --git a/media/code-65.png b/media/code-65.png new file mode 100644 index 0000000..6df0358 Binary files /dev/null and b/media/code-65.png differ diff --git a/resources/cwe-119.md b/resources/cwe-119.md new file mode 100644 index 0000000..d2ea73c --- /dev/null +++ b/resources/cwe-119.md @@ -0,0 +1,25 @@ +## SecurityExplained S-95 + +## CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer +Although the software operates on a memory buffer, it can read from or write to memory locations outside of the buffer's intended border. + +Buffer errors are frequent in software that uses a memory buffer to execute actions. An attacker may be able to read or write data outside the intended buffer due to a lack of or incorrect validation of input data. Memory corruption is a term used to describe this flaw. +Specific languages support direct memory addressing, but they don't always check that the addresses are valid for the referred buffer. As a result, read and write operations on memory regions associated with another buffer, variables, data structures, and so on may be done. + + +### Potential Impact: + +An attacker who has complete control over the user input can read or write to any memory location. As a result, it's possible to extract potentially sensitive data from memory and create memory corruption, crash the application, or even run arbitrary code on the target machine. + +Use a language that prevents this vulnerability from occurring or provides constructs that make it easy to avoid this weakness. + +Buffer overflows are not a problem in many languages that do their memory management, such as Java and Perl. Other languages often provide overflow protection, such as Ada and C#, but the programmer can remove it. + +Run or create the software using features or extensions that automatically provide a buffer overflow mitigation or elimination technique. + + +#### A more detailed information about this vulnerability can be found here: https://cwe.mitre.org/data/definitions/119.html + + + +[Follow Twitter Thread](https://twitter.com/harshbothra_/status/1511207010242494465) diff --git a/resources/cwe-20.md b/resources/cwe-20.md new file mode 100644 index 0000000..7fb4fb3 --- /dev/null +++ b/resources/cwe-20.md @@ -0,0 +1,45 @@ +## SecurityExplained S-63 + +### CWE-787: Improper Input Validation + +The product/program does not validate or validate poorly or input that can disrupt a program's control flow or data flow. When software fails to properly validate input, an attacker can construct it in a way that the rest of the application does not expect. As a result, components of the system may receive unwanted input, resulting in a change in control flow or even arbitrary code execution. The flaw appears during the Architecture and Design, as well as the implementation stages. + +#### It allows to: +- Cause the Program to Stop +- Set Arbitrary Command Execution +- Cause Excessive Expenditure of Resources +- Read and Compromise Personal Information + +#### Input validation can be applied to: +1. Raw Data - Strings, Numbers, Parameters, File Contents, etc. +2. Metadata - Information about the raw data, such as headers or size + + +#### Upon entering the code, many properties of raw data or metadata may need to be checked, such as: +- Size, length, frequency, price, rate, number of operations, duration, and so on (all defined quantities). +- Incorporate symbolic keys or other items into hash tables, associative arrays, etc. +- Individual data items, raw data and metadata, references, and so on must all be consistent. +- Implied or derived quantities, such as the real file size rather than defined file size. +- More complicated data structures like indices, offsets, or placements. + +It's important to keep in mind that "input validation" might have a variety of meanings depending upon whether you ask or whatever classification scheme you use. When referring or mapping to this CWE entry, take caution. + +#### Possible Attacks ++ SQL Injection ++ Cross-Site Scripting (XSS) ++ Command Injection ++ Arbitrary Code Execution ++ Application-Level DOS Attack ++ and other similar attacks + +#### Mitigations + +1. Use a framework like Struts or the OWASP ESAPI Validation API to validate input. It's important to remember that adopting a framework doesn't solve all input validation issues; be aware of any flaws in the framework itself. +2. Parameters or arguments, cookies, anything read from the network, environment variables, reverse DNS lookups, query results, request headers, URL components, e-mail, files, filenames, databases, and any external systems that provide data to the application are all potential areas where untrusted inputs can enter your software. Keep in mind that API calls can be used to obtain such inputs + + +#### A more detailed information about this vulnerability can be found here: https://cwe.mitre.org/data/definitions/20.html + + + +[Follow Twitter Thread](https://twitter.com/harshbothra_/status/1499723526948855808) diff --git a/resources/cwe-200.md b/resources/cwe-200.md new file mode 100644 index 0000000..27f5660 --- /dev/null +++ b/resources/cwe-200.md @@ -0,0 +1,33 @@ +## SecurityExplained S-87 + +### CWE Top 25: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor + +The product makes sensitive information available to someone who isn't explicitly permitted to access it. + +CWE-200 arises when confidential information (e.g., application systems and network information, user-supplied data such as names email addresses) is made available to individuals who are not authorized to see it. + +This flaw could be the outcome of various issues involving the disclosure of sensitive information. +When the following conditions exist, the information is considered sensitive: +It is sensitive within the product's operations (e.g., information with restricted access, private messages, etc.) +It includes information about the product, its environment, or connected systems that the application is not supposed to reveal. +The application relies on sensitive information-containing resources (e.g., databases) and inadvertently reveals how an unauthorized person could access such resources. + + +# Example: +This code tries to connect to a database and prints any errors it encounters. +Example Language: Java + +If an error occurs, the reported message reveals the location of the script's configuration file. An attacker can use this information to target the configuration file (perhaps exploiting a Path Traversal weakness). If the attacker can read the file, they will access the database's credentials. + +# Mitigations: +The fundamental strategy for protecting sensitive data is to use secure storage and access techniques. However, information assets must first be identified to identify what should be secured and how it should be protected. +Divide the system into "safe" zones where clear trust lines can be drawn. Allowing sensitive data to leave the trust boundary is not a good idea, and always be cautious when interacting with a division outside of the secure zone. +Never keep/store log files with world-readable permissions; +Architects and designers should utilize the principle of least privilege to determine whether privileges should be used and when they should be discarded. + + +#### A more detailed information about this vulnerability can be found here: https://cwe.mitre.org/data/definitions/200.html + + + +[Follow Twitter Thread](https://twitter.com/harshbothra_/status/1508300855090372613) diff --git a/resources/cwe-276.md b/resources/cwe-276.md new file mode 100644 index 0000000..2713509 --- /dev/null +++ b/resources/cwe-276.md @@ -0,0 +1,33 @@ +## SecurityExplained S-93 + +### CWE-276: Incorrect Default Permissions +Installed file permissions are specified to allow anyone to edit those files during installation. + +During the installation process, the software may apply unwanted permissions to directories, files, or other objects, which is called this flaw. As a result, a malicious user may be able to override security requirements that were not intended. + +Access control lists (ACLs) differentiate access privileges for distinct users and groups in most current operating systems. +A principal (e.g., a process or a threat acting on behalf of a user) works on objects in modern operating systems. Access to these objects (e.g., files, directories, registry keys, etc.) is critical for security measures employed in many operating systems, and permissions enforced on essential components of the operating system can influence system behaviour. + +### Potential Impact: +This flaw is usually exploitable only locally. A malicious individual could obtain access to sensitive data, tamper with sensitive data, or wholly compromise the susceptible system. + +In Linux, any local user with world-writable access on a setuid/setgid executable can insert malicious content into it and execute arbitrary code with the file's owner's privileges. + +Any application that can be writable by an unauthorized user is a security risk. This is because it can be exploited to elevate privileges on the system, such as if a malicious and unprivileged user updated it before being executed by a privileged one. + + +### Mitigations: +According to the architecture, only users who genuinely require those operations should have access to and modify file attributes. + +Users and groups should appropriately manage ownership of files and folders. For example, allowing unwanted groups access to protected information is never good. + +During installation, keep note of software's permissions for directories, files, and registry keys. + +Never allow apps to give executable files world-readable permissions, especially in the system PATH environment variable or any other default search path, such as Windows, Windows/system32 directories, etc. + + +#### A more detailed information about this vulnerability can be found here: https://cwe.mitre.org/data/definitions/276.html + + + +[Follow Twitter Thread](https://twitter.com/harshbothra_/status/1510488017076596743) diff --git a/resources/cwe-287.md b/resources/cwe-287.md new file mode 100644 index 0000000..183b082 --- /dev/null +++ b/resources/cwe-287.md @@ -0,0 +1,45 @@ +## SecurityExplained S-97 + +## CWE-287: Improper Authentication + +When an actor claims to have a particular identity, the program either does not prove or does not sufficiently verify that claim. +Improper Authentication is a vulnerability that describes the ineffective techniques for verifying a user's identity. + +This flaw could be exploited by multiuser systems and apps that use multiple permission levels. + +This flaw happens when an application incorrectly verifies a user's identity. An attacker can access certain rights within the application or expose sensitive information if software wrongly checks user login information or permits the use of different forms of malicious credentials collection (e.g. brute force, spoofing). + +### Example: + +The "id" argument in the HTTP GET request is used by software to assign privileges within the application. For example, if the option is set to "user," the application will allow you to view the data; if it is set to "admin," you will be able to update the data on the page. + + +http://vulnerable.com/index.php?view=1&id=user +http://vulnerable.com/index.php?view=1&id=admin + +An attacker who sets the "group" option to "admin" will be allowed to change the website. + +The previous example is simply a demonstration of how the flaw works. However, in real-world circumstances, poor Authentication can be caused by various factors, including software misconfiguration, human error, etc. + + + +### Potential Impact: + +This flaw can expose resources or functionality to unauthorized individuals, exposing sensitive information or allowing attackers to run arbitrary code. + +An attacker can take advantage of this flaw via various methods, including brute-force attacks, session fixation, and Man-in-the-Middle (MitM) attacks. + + +### Mitigations: +Tools and techniques that involve manual (human) analysis, such as penetration testing, threat modelling, and interactive tools that allow the tester to record and change an active session, can be used to discover this flaw. +Use an authentication framework or library such as the OWASP ESAPI Authentication feature. + +Robust authentication procedures, including anti-brute force and session protection mechanisms, are recommended to protect the application against this flaw. + + + +#### A more detailed information about this vulnerability can be found here: https://cwe.mitre.org/data/definitions/287.html + + + +[Follow Twitter Thread](https://twitter.com/harshbothra_/status/1511954434007310336) diff --git a/resources/cwe-476.md b/resources/cwe-476.md new file mode 100644 index 0000000..4ebbd3c --- /dev/null +++ b/resources/cwe-476.md @@ -0,0 +1,37 @@ +## SecurityExplained S-92 + +### CWE-476: NULL Pointer Dereference + +When an application dereferences a pointer that it considers valid but is NULL, it usually crashes or exits. + +Several faults, including race situations and simple programming blunders, can cause NULL pointer to dereference concerns. In C/C++ languages, NULL pointer dereferences mistakes are widespread. A pointer is a data type in programming languages that refers to a memory location. The pointer is considered dereferenced once it has gotten the value of the location. When an application dereferences a pointer that should be a valid address but returns NULL, this is known as the NULL pointer dereference vulnerability. + +This type of vulnerability could affect software written in C/C++, Assembly, or any other language that uses pointers. + +The programmer assumes that the system has a property named "cmd" specified at all times. When an attacker takes control of the application's environment and removes "cmd," the software throws a NULL pointer exception when trying to invoke the trim() method. + + +### Potential Impact: + +In most cases, NULL pointer dereferences errors cause the application to crash, but in some cases, code execution is possible. This flaw can result in a denial of service attack against the entire system or be exploited to take complete control over it, depending on the application's privileges. + +When the null is equivalent to the 0x0 memory address and the secret code has access, it can write or read memory, leading to the code execution. + +Unless exception handling (on some systems) is available and implemented, NULL pointer differences usually result in the process of failing. Even when exception handling is utilized, returning software to a safe operation can be pretty challenging. + + +### Mitigations: + +Before utilizing a value, check the function's return value outputs to ensure it isn't NULL. + +Nearly all NULL pointer dereferences can be avoided if all pointers that could be updated are sanity-checked before usage. + +Validate input to variables and data stores that may accept input from a third party. + +Use automated static analysis techniques to look for this type of flaw. Several recent methods employ data flow analysis to reduce the number of false positives. ( This isn't a perfect solution because it's impossible to achieve 100% accuracy and coverage) + +#### A more detailed information about this vulnerability can be found here: https://cwe.mitre.org/data/definitions/476.html + + + +[Follow Twitter Thread](https://twitter.com/harshbothra_/status/1509461251277012997) diff --git a/resources/cwe-522.md b/resources/cwe-522.md new file mode 100644 index 0000000..0e5875c --- /dev/null +++ b/resources/cwe-522.md @@ -0,0 +1,28 @@ +## SecurityExplained S-89 + +### CWE-522: Insufficiently Protected Credentials + +The product transfers or saves authentication credentials, but it does so improperly that it can be intercepted or retrieved by unauthorized individuals. + +This flaw relates to an architectural security approach that has been misdesigned. Another form of credential attack uses flaws in how passwords are encoded, saved, and handled by a web application, network, or software system. + +Risky development practices, such as storing passwords in insecure locations, storing credentials in plaintext, storing user passwords using poor or reproducible cryptographic techniques, or using hard-coded credentials, generate vulnerabilities that can be exploited to recover clients' credentials which can then be used to attack applications and other apps the user logs into. + +### Potential Impact: +An attacker could access user accounts and sensitive data stored within them. + +### Mitigation: + +To secure the credentials, use an appropriate security mechanism. + +Creating a firm password policy in your organization, such as prohibiting the use of passwords found in recent data breaches or well-known weak passwords, or encouraging the use of long, randomly generated passwords in conjunction with password managers, to improve security. + +• To protect the credentials, make proper use of cryptography. +• To secure credentials, follow industry best practices (e.g. LDAP, Keystore, etc.) + + +#### A more detailed information about this vulnerability can be found here: https://cwe.mitre.org/data/definitions/522.html + + + +[Follow Twitter Thread](https://twitter.com/harshbothra_/status/1509113963195219968) diff --git a/resources/cwe-611.md b/resources/cwe-611.md new file mode 100644 index 0000000..1d4f2b7 --- /dev/null +++ b/resources/cwe-611.md @@ -0,0 +1,43 @@ +## SecurityExplained S-91 + +### CWE-611: Improper Restriction of XML External Entity Reference + +Improper Restriction of XML External Entity Reference, or XXE, refers to a situation in which an XML parser is incorrectly set, allowing an attacker to connect directly with local or external files. + +When an application executes an XML document that contains entities pointing to external URIs, CWE-611 vulnerabilities can occur. These URIs resolve to assets outside the application's control, resulting in potentially dangerous execution of activities prescribed by the external assets. + + +An issue in parsing an XML file containing XML entities with URIs that potentially refer to documents beyond the intended place is the source of the flaw. If the program fails to check the path to documents before including them, the attacker can consist of any file from a local or remote system and have it displayed by the application. + +XML uses a tree-like structure of tags and data to store and convey data. A document type definition (DTD) can be found in an XML document, and its declarations describe the document's structure, data values, rights, and so on. The DTD might be embedded in the document or referenced from another location. You can specify "XML entities" in DTDs, which refer to values in the document in the same way that variables are used in programming languages. + +The XXE attack is based on the ability of the XML language to declare arbitrary entities using an external Data Type Definition (DTD) and the ability to read and execute files. + +### Potential Impact: + +The impact can range from local / remote file inclusion to remote command execution and entire system compromise, depending on the application's implementation and architecture. + +This vulnerability can also be exploited to execute internal network port scans on the affected machine or servers. + +The attacker may be able to access arbitrary files on the system if a malicious DTD is included and a default entity resolver is enabled. + +The DTD can include any HTTP request that the server can handle. Therefore, other attacks could be launched due to the server's trust connection with other entities. + +### Mitigations: + +This vulnerability is frequently introduced to the program during the architecture and design phase. Therefore, it is nearly impossible to mitigate this vulnerability without modifying the application source code in most circumstances. + +External entity expansion can be disabled in many XML parsers and validators. + +Allowing application functionality that parses XML documents should be avoided. + +Implement server-side input validation, filtering, or sanitization that is positive allowlisting to prohibit malicious data from entering XML documents or headers. + +Configure the XML parser so that no DTD declarations are validated or processed. + + +#### A more detailed information about this vulnerability can be found here: https://cwe.mitre.org/data/definitions/611.html + + + +[Follow Twitter Thread](https://twitter.com/harshbothra_/status/1509795203900608513) diff --git a/resources/cwe-732.md b/resources/cwe-732.md new file mode 100644 index 0000000..e0819bf --- /dev/null +++ b/resources/cwe-732.md @@ -0,0 +1,35 @@ +## SecurityExplained S-88 + +### CWE-732: Incorrect Permission Assignment for Critical Resource + +The product defines permissions for a security-critical resource so that unwanted actors can read or modify it. +When a resource's permissions are set to allow access to a broader range of actors than is required, sensitive information may be exposed, or undesired parties may modify the resource. This is very risky when the resource is tied to program configuration, execution, or sensitive user data. + +This flaw arises due to the deployment of an architectural security strategy. The developer may make assumptions about the product's operating environment, such as that the software runs on a single-user system or is only available to trusted administrators. Permissions become a concern when the software is run in a different environment. +When the user starts the program, the developer may establish loose permissions to reduce difficulties, then add documentation saying that permissions should be tightened. However, because system administrators and users do not always read the documentation, insecure permissions may be kept unaltered. + + +# Example: +This code creates a new user's home directory and makes that user directory's owner. If the user does not have permission to own the new directory, the directory is removed. + + +The directory is created with the default permissions 0777 because the optional "mode" argument is absent from the call to mkdir(). Setting the new user as the directory's administrator does not modify the directory's permissions, which are still set to the default. Any user can read and write to the directory by default, allowing an exploit on the user's files. + +# Potential Impact: + +An attacker may be able to delete or damage essential data in the related resource, such as entries from a database, by destroying or corrupting it. +An attacker could exploit this vulnerability to read private information from the connected resource, such as credentials or configuration information stored in a file. +To obtain privileges, an attacker may change crucial attributes of the related resource, such as replacing a world-writable executable with Malware. + + +# Mitigations: +Check to verify whether a critical resource, such as a configuration file, has insecure permissions (such as being editable by any regular user) and generate an error or even quits the software if there is a chance an unauthorized person has updated the resource. + +Run the code in a "jail" or similar sandbox environment where strict limits separate the process and the operating system. + + +#### A more detailed information about this vulnerability can be found here: https://cwe.mitre.org/data/definitions/732.html + + + +[Follow Twitter Thread](https://twitter.com/harshbothra_/status/1508761138208514055) diff --git a/resources/cwe-787.md b/resources/cwe-787.md new file mode 100644 index 0000000..efd8d83 --- /dev/null +++ b/resources/cwe-787.md @@ -0,0 +1,39 @@ +## SecurityExplained S-61 + +### CWE-787: Out-of-bounds Write + +The Out-of-bounds Write is a software security vulnerability that occuers when the data is written beyond the boundaries (i.e. past the end, before the beginning) of the intended buffer. This weakness is also listed in the CWE TOP 25 (2021). This has been give the CWE ID as CWE-787 + +- This vulnerability could result into buffer overflows, memory corruption, crash of the software or even a code execution. As per the cwe.mitre.org, The software may modify an index or perform pointer arithmetic that references a memory location that is outside of the boundaries of the buffer. A subsequent write operation then produces undefined or unexpected results. + +- An alternate term of this weakness is Memory Corruption. CWE website defines memory corruption as, The generic term "memory corruption" is often used to describe the consequences of writing to memory outside the bounds of a buffer, or to memory that is invalid, when the root cause is something other than a sequential copy of excessive data from a fixed starting location. This may include issues such as incorrect pointer arithmetic, accessing invalid pointers due to incomplete initialization or memory release, etc. + +- This weakness is usually introduced while the implementation phase of the software. This type of attacks are majorly observed in softwares based on C and C++ programming languages. + + +# Example Code + +- The following is an example of code that may result in a buffer underwrite, if find() returns a negative value to indicate that ch is not found in srcBuf: + +``` +(bad code) +Example Language: C +int main() { +... +strncpy(destBuf, &srcBuf[find(srcBuf, ch)], 1024); +... +} + +``` + +- If the index to srcBuf is somehow under user control, this is an arbitrary write-what-where condition. + + +- This vulnerability can be detected using the manual and automated static as well as dynamic analysis using fuzzing techniques. + + +#### A more detailed information about this vulnerability can be found here: https://cwe.mitre.org/data/definitions/787.html + + + +[Follow Twitter Thread](https://twitter.com/harshbothra_/status/1477258377252065281?s=20&t=QR8LCZPmGCrSu2SuCUBCgQ) diff --git a/resources/cwe-798.md b/resources/cwe-798.md new file mode 100644 index 0000000..d81bafa --- /dev/null +++ b/resources/cwe-798.md @@ -0,0 +1,31 @@ +## SecurityExplained S-96 + +## CWE-798: Use of Hard-coded Credentials +Hard-coded credentials, such as a password or cryptographic key, are included in the software, which it uses for inbound authentication, outbound communication with external components, and internal data encryption. +The flaw exists due to hardcoded passwords, cryptographic keys, tokens, and other authentication credentials that cannot be modified in code. + +Hard-coded credentials usually leave a significant gap in the security system, allowing an attacker to bypass the software administrator's authentication. The system administrator may have a hard time detecting this flaw. Even if it is found, fixing it can be challenging. Thus the administrator may be forced to disable the product altogether. + +The following are the two primary variations: +Inbound: A default administrator account is generated in the Inbound variation, and a simple password is hard-coded into the product and associated with that account. This hard-coded password is the same for each product installation. It usually is impossible for system administrators to change or disable it without directly editing the programme or updating the software. Anyone with knowledge of the password can access the product if it is ever found or released (a typical occurrence on the Internet). +Finally, massive attacks like supply-chain attacks will be possible because all programme installations will use the same password, even if they are from different businesses. + +2. Outbound: Front-end systems that authenticate with a back-end service are considered outbound. The back-end service may require a fixed password that can be easily obtained. Those back-end credentials could be hard-coded into the front-end software by the coder. Any user of that programme could extract the password. +Client-side systems with hard-coded passwords are considerably more dangerous because extracting a password from a binary is usually highly straightforward. + +This problem can affect any software with a management interface or scripting capability. + + +## Mitigations: + +If your application has hardcoded credentials that allow unauthorised remote access, you must immediately take action. It is recommended to block access to the impacted URLs or scripts in applications where source code updates are difficult or impossible to make (e.g. credentials are kept in an a.dll file in an ASP.NET application). +Store passwords, keys, and other credentials outside of the code in a password-protected, encrypted configuration file or database secured from all outsiders, even other local users on the same machine, for outbound authentication. + +For inbound authentication, deploy a "first login" option that requires the user to submit a unique, strong password or key rather than hard-coding a default username and password, key, or other authentication credentials for first-time logins. +It's also necessary to set up your Web Application Firewall (WAF) to restrict access to a website if the application receives hardcoded credentials via a request parameter. + +#### A more detailed information about this vulnerability can be found here: https://cwe.mitre.org/data/definitions/798.html + + + +[Follow Twitter Thread](https://twitter.com/harshbothra_/status/1511592046468902913) diff --git a/resources/cwe-862.md b/resources/cwe-862.md new file mode 100644 index 0000000..ec0a59c --- /dev/null +++ b/resources/cwe-862.md @@ -0,0 +1,33 @@ +## SecurityExplained S-94 + +## CWE-862: Missing Authorization +When an actor tries to access a resource or conduct an action, the software does not complete an authorization check. + +Authorization evaluates whether a user with a given identity can access a shared resource based on the user's privileges and any rights or other access-control criteria that apply to the asset. +Users can access data or conduct actions that they shouldn't be able to do if access control measures aren't in place. This can result in various issues, including data leakage, denial of service, and arbitrary code execution. + +This flaw arises from a neglected security approach during the architecture and design process. Authorization defects may occur when a single-user application is switched to a multi-user environment. +A developer may create authorization flaws because of a lack of awareness of the underlying technologies. For example, a developer might believe that attackers won't be able to change particular inputs like headers or cookies. + + +### Potential Impact: + +An attacker could read sensitive data by reading it straight from an unrestricted data store or by using improperly protected privileged functionality. + +An attacker may be able to gain access to, edit, or delete data for which they are not allowed. This can be pretty harmless (for example, seeing an admin console landing page but not being able to see any data) or extremely dangerous (for example (e.g. complete visibility into user data). + +### Mitigations: + +Separate the software into four sections: anonymous, regular, privileged, and administrative. You may reduce the attack surface by mapping roles to data and functions adequately. + +Use role-based access control (RBAC) to enforce the roles at the appropriate boundaries. + +Use a well-tested library or framework to prevent this flaw from arising or provide constructs that make it easy to avoid. Consider employing authorization frameworks like the JAAS Authorization Framework, for example. + +Confirm that the business logic carries out access control checks. These tests may differ from access control checks performed on more general resources such as files, connections, processes, RAM, and database records. + +#### A more detailed information about this vulnerability can be found here: https://cwe.mitre.org/data/definitions/862.html + + + +[Follow Twitter Thread](https://twitter.com/harshbothra_/status/1510835305019895808) diff --git a/resources/cwe-918.md b/resources/cwe-918.md new file mode 100644 index 0000000..bdc4a55 --- /dev/null +++ b/resources/cwe-918.md @@ -0,0 +1,41 @@ +## SecurityExplained S-90 + +### CWE-918: Server-Side Request Forgery (SSRF) +The web server receives a URL or similar request from an upstream component and obtains its contents, but it does not check that the request is routed to the correct destination. + +Malicious parties can use CWE-918, also known as server-side request forgeries (SSRF), to trick a server into making requests to obtain access to internal infrastructure, sensitive data, etc. + +The use of URLs helps identify the attack surface for SSRF. Although sanitization and allow lists are two more effective techniques available, they can be challenging to manage. + +Server-Side Request Forgery (SSRF) is an attack in which an attacker uses a web application's ability to make unauthorized requests to internal or external services. + +For example, if the program contains functionality that sends requests to other servers and the attacker can tamper with it, your web server can be turned into a proxy. As a result, an attacker can reach systems that are otherwise behind a firewall or access private resources on the local host itself, depending on the web server's settings. + +A malicious attacker can use this vulnerability to force a server-side application to send HTTP requests to their chosen domain. + +### Potential Impact: + +A typical example is information disclosure via a port scan of internal hosts and returned service banners enumerated. In certain circumstances, a detailed error message will be sent to indicate the port's status; in others, a time-based approach will be required. + +If a hosting provider hosts the application, it can reveal instance metadata, such as public SSH keys, credentials, and private IP address blocks. + +In rare situations, the vulnerability can be leveraged to access the contents of local files on the webserver. This is accomplished by employing a different handler: 'file:/'. An attacker may be able to view web application source code, configuration files, and other sensitive data. + +### Mitigations: + +Keep an allowlist of DNS or IP addresses that the web application is allowed to visit. + +If a denylist is required, ensure that all user input is thoroughly validated and that no private IP addresses are allowed. + +Avoid delivering raw responses from the server-side to the client-side by sanitizing all user input used in URLs and other requests. + +To restrict all superfluous traffic, use firewall policies or network access control rules. + +Assure that only HTTP(S) protocols can be used, and if different handlers are required, ensure that a robust allowlist is employed. It's also essential to avoid HTTP redirection. + + +#### A more detailed information about this vulnerability can be found here: https://cwe.mitre.org/data/definitions/918.html + + + +[Follow Twitter Thread](https://twitter.com/harshbothra_/status/1509461251277012997) diff --git a/resources/getting-into-cybersecurity.md b/resources/getting-into-cybersecurity.md new file mode 100644 index 0000000..3d6bdce --- /dev/null +++ b/resources/getting-into-cybersecurity.md @@ -0,0 +1,3 @@ +## SecurityExplained S-65: How do I get Started in Cyber Security? — My Perspective & Learning Path! + +Blog: https://hbothra22.medium.com/how-do-i-get-started-in-cyber-security-my-perspective-learning-path-b53065189ba5 \ No newline at end of file diff --git a/resources/intro-to-cwe.md b/resources/intro-to-cwe.md new file mode 100644 index 0000000..bd9f0ce --- /dev/null +++ b/resources/intro-to-cwe.md @@ -0,0 +1,48 @@ +## SecurityExplained S-60: + +### Introduction to CWE + +According to the official description, the CWE™ (Common Weakness Enumeration) is a community-developed list of software and hardware weakness types. + +It serves as a common language, a measuring stick for security tools, and as a line for weakness identification, mitigation, and prevention efforts. The list includes more than 924 Common Weakness in Software & Hardware. + +**There are multiple options available to look for a CWE such as:** +- By Software Development +- By Hardware Design +- By Research Concepts +- External Mappings such as (CWE TOP 25, OWASP TOP 10, Software Fault Pattern Cluster and more) + + +**The CWE TOP 25 is a list of top 25 most dangerous software weakness observed. These Weakness includes:** + +- Out-of-bounds Write +- Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') +- Out-of-bounds Read +- Improper Input Validation +- Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') +- Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') +- Use After Free +- Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') +- Cross-Site Request Forgery (CSRF) +- Unrestricted Upload of File with Dangerous Type +- Missing Authentication for Critical Function +- Integer Overflow or Wraparound +- Deserialization of Untrusted Data +- Improper Authentication +- NULL Pointer Dereference +- Use of Hard-coded Credentials +- Improper Restriction of Operations within the Bounds of a Memory Buffer +- Missing Authorization +- Incorrect Default Permissions +- Exposure of Sensitive Information to an Unauthorized Actor +- Insufficiently Protected Credentials +- Incorrect Permission Assignment for Critical Resource +- Improper Restriction of XML External Entity Reference +- Server-Side Request Forgery (SSRF) +- Improper Neutralization of Special Elements used in a Command ('Command Injection') + + + +MindMap Link: https://www.xmind.net/m/icrqti + +[Follow Twitter Thread](https://twitter.com/harshbothra_/status/1477258377252065281?s=20&t=QR8LCZPmGCrSu2SuCUBCgQ) diff --git a/resources/mfa-bypass.md b/resources/mfa-bypass.md new file mode 100644 index 0000000..939b96e --- /dev/null +++ b/resources/mfa-bypass.md @@ -0,0 +1,3 @@ +## SecurityExplained S-67: MFA Bypass Techniques + +Blog: https://hbothra22.medium.com/bypassing-the-protections-mfa-bypass-techniques-for-the-win-8ef6215de6ab \ No newline at end of file diff --git a/resources/ruby-erb-ssti.md b/resources/ruby-erb-ssti.md new file mode 100644 index 0000000..6136ffc --- /dev/null +++ b/resources/ruby-erb-ssti.md @@ -0,0 +1,28 @@ +### SecurityExplained S-59: Ruby ERB SSTI + +``` +Server-Side Template Injection (SSTI) vulnerabilities occurs when an user-supplied data is inserted into a template and insecurely evaluated as an expression by the template engine. This may allow an attacker to trick the template engine into evaluation an expression that could allow an attacker to execute system commands or gain a remote shell. + +To look for template injection vulnerability, it is essential to enumerate and know if the template engine is in use. If the application uses template engine, the next thing is to know what language based template injection is used and what all classes and methods are accessible that could be chained together to perform the desired action. + +# Looking for Template Injection in Ruby ERB: + +1. Let's assume the target application is running Ruby and a specific input field/functionality looks like using a template engine. +2. Now, try a simple payload like: <%=7*7%> +3. If the output is "49", it is confirmed that the application makes use of Ruby ERB Template Engine. + + +After confirming the template engine as Ruby ERB, one can try for following payloads for actions such as local file read or command execution: + +<%= system('cat /etc/passwd') %> +<%= `ls /` %> +<%= IO.popen('ls /').readlines() %> +<% require 'open3' %><% @a,@b,@c,@d=Open3.popen3('whoami') %><%= @b.readline()%> +<% require 'open4' %><% @a,@b,@c,@d=Open4.popen4('whoami') %><%= @c.readline()%> + + +A detailed write up on Ruby ERB Template Injection by TrustedSec: https://www.trustedsec.com/blog/rubyerb-template-injection/ + +``` + +[Follow Twitter Thread](https://twitter.com/harshbothra_/status/1498324305872318464) diff --git a/resources/scope-based-recon.md b/resources/scope-based-recon.md new file mode 100644 index 0000000..ff4d678 --- /dev/null +++ b/resources/scope-based-recon.md @@ -0,0 +1,3 @@ +## SecurityExplained S-66: Scope Based Recon Methodology: Exploring Tactics for Smart Recon + +Blog: https://hbothra22.medium.com/scope-based-recon-smart-recon-tactics-7e72d590eae5 \ No newline at end of file diff --git a/resources/vulnerabilities-in-cookies.md b/resources/vulnerabilities-in-cookies.md new file mode 100644 index 0000000..fca66ac --- /dev/null +++ b/resources/vulnerabilities-in-cookies.md @@ -0,0 +1,3 @@ +## SecurityExplained S-64: Vulnerabilities in Cookie Based Authentication + +Blog: https://hbothra22.medium.com/got-cookies-cookie-based-authentication-vulnerabilities-in-wild-55fa7c374be0 diff --git a/resources/vulnerable-code-32.md b/resources/vulnerable-code-32.md new file mode 100644 index 0000000..0da1143 --- /dev/null +++ b/resources/vulnerable-code-32.md @@ -0,0 +1,15 @@ +### SecurityExplained S-45: Vulnerable Code Snippet - 32 + +#### Vulnerable Code: + +![Vulnerable Code](../media/code-32.jpg) + + +#### Solution: + +This code is vulnerable to open redirection attack as the function "get_success_url" on line-27 doesn't properly implement the checks and the "Next" parameter is not using any whitelists. This may result into a redirection issue. + +Twitter Thread: https://twitter.com/harshbothra_/status/1493042310589947906 + +##### Code Credits: @SonarSource + \ No newline at end of file diff --git a/resources/vulnerable-code-33.md b/resources/vulnerable-code-33.md new file mode 100644 index 0000000..f450072 --- /dev/null +++ b/resources/vulnerable-code-33.md @@ -0,0 +1,15 @@ +### SecurityExplained S-46: Vulnerable Code Snippet - 33 + +#### Vulnerable Code: + +![Vulnerable Code](../media/code-33.jpg) + + +#### Solution: + +This code is vulnerable to RCE via SSTI due to improper filtration. Additionally, the replace() function is case sensitive and the filters can be bypassed by case juggling to execute an XSS attack as well. + +Twitter Thread: https://twitter.com/harshbothra_/status/1493412245404938241 + +##### Code Credits: @0xryuk + \ No newline at end of file diff --git a/resources/vulnerable-code-34.md b/resources/vulnerable-code-34.md new file mode 100644 index 0000000..0cb7473 --- /dev/null +++ b/resources/vulnerable-code-34.md @@ -0,0 +1,15 @@ +### SecurityExplained S-47: Vulnerable Code Snippet - 34 + +#### Vulnerable Code: + +![Vulnerable Code](../media/code-34.jpg) + + +#### Solution: + +This code is vulnerable IDOR as the user_id and record_id are not properly protected by the authorization verification and as a result an attacker who can guess/know these two parameters can access other user's information. + +Twitter Thread: https://twitter.com/harshbothra_/status/1493789734392373253 + +##### Code Credits: @ChetanyaKunndra + \ No newline at end of file diff --git a/resources/vulnerable-code-35.md b/resources/vulnerable-code-35.md new file mode 100644 index 0000000..e43b8ba --- /dev/null +++ b/resources/vulnerable-code-35.md @@ -0,0 +1,16 @@ +### SecurityExplained S-48: Vulnerable Code Snippet - 35 + +#### Vulnerable Code: + +![Vulnerable Code](../media/code-35.jpg) + + +#### Solution: + +The code is vulnerable to XSS and LFI. The focus of this code is that the filename can be used as a payload to execute JavaScript and perform an XSS attack. +When filtering a function always remember that it's more than one bug that can be exploited in it. For example this is highly vulnerable to LFI but it's also vulnerable to XSS. + +Twitter Thread: https://twitter.com/harshbothra_/status/1494127206552985605 + +##### Code Credits: @Brumens2 + \ No newline at end of file diff --git a/resources/vulnerable-code-36.md b/resources/vulnerable-code-36.md new file mode 100644 index 0000000..35f9698 --- /dev/null +++ b/resources/vulnerable-code-36.md @@ -0,0 +1,14 @@ +### SecurityExplained S-49: Vulnerable Code Snippet - 36 + +#### Vulnerable Code: + +![Vulnerable Code](../media/code-36.jpg) + + +#### Solution: + +This code is vulnerable to Server-Side Request Forgery due to improper filtration in the "connName". An attacker can abuse it perform the attack successfully. + +Twitter Thread: https://twitter.com/harshbothra_/status/1494127206552985605 + +##### Code Credits: @SonarSource \ No newline at end of file diff --git a/resources/vulnerable-code-37.md b/resources/vulnerable-code-37.md new file mode 100644 index 0000000..ac3e9a5 --- /dev/null +++ b/resources/vulnerable-code-37.md @@ -0,0 +1,14 @@ +### SecurityExplained S-50: Vulnerable Code Snippet - 37 + +#### Vulnerable Code: + +![Vulnerable Code](../media/code-37.jpg) + + +#### Solution: + +This code is vulnerable to Host Header Injection as the code takes the value of HOST in the password reset link from request itself. This may allow an attacker to inject arbitrary host in the password reset link and get hold of the valid reset token to perform a successful password reset attack. + +Twitter Thread: https://twitter.com/harshbothra_/status/1494777872929542144 + +##### Code Credits: @Brumens2 \ No newline at end of file diff --git a/resources/vulnerable-code-38.md b/resources/vulnerable-code-38.md new file mode 100644 index 0000000..cfa068e --- /dev/null +++ b/resources/vulnerable-code-38.md @@ -0,0 +1,14 @@ +### SecurityExplained S-51: Vulnerable Code Snippet - 38 + +#### Vulnerable Code: + +![Vulnerable Code](../media/code-38.jpg) + + +#### Solution: + +The code is vulnerable to DOM-based XSS and allows execution of XSS using "s" parameter using payloads like: x'onmouseover=alert(1)// + +Twitter Thread: https://twitter.com/harshbothra_/status/1495224184611524608 + +##### Code Credits: @Brumens2 \ No newline at end of file diff --git a/resources/vulnerable-code-39.md b/resources/vulnerable-code-39.md new file mode 100644 index 0000000..4457599 --- /dev/null +++ b/resources/vulnerable-code-39.md @@ -0,0 +1,14 @@ +### SecurityExplained S-52: Vulnerable Code Snippet - 39 + +#### Vulnerable Code: + +![Vulnerable Code](../media/code-39.jpg) + + +#### Solution: + +This code is vulnerable to XPATH Injection. 🥷 + +Twitter Thread: https://twitter.com/harshbothra_/status/1495542532784246784 + +##### Code Credits: @SonarSources \ No newline at end of file diff --git a/resources/vulnerable-code-40.md b/resources/vulnerable-code-40.md new file mode 100644 index 0000000..ca0ff85 --- /dev/null +++ b/resources/vulnerable-code-40.md @@ -0,0 +1,14 @@ +### SecurityExplained S-53: Vulnerable Code Snippet - 40 + +#### Vulnerable Code: + +![Vulnerable Code](../media/code-40.jpg) + + +#### Solution: + +This code is vulnerable to Local File Inclusion as the backslash character can be used in a path traversal attack (..\) to disclose arbitrary files from the (Windows) host. + +Twitter Thread: https://twitter.com/harshbothra_/status/1495950722000580608 + +##### Code Credits: @SonarSources \ No newline at end of file diff --git a/resources/vulnerable-code-41.md b/resources/vulnerable-code-41.md new file mode 100644 index 0000000..096fd27 --- /dev/null +++ b/resources/vulnerable-code-41.md @@ -0,0 +1,14 @@ +### SecurityExplained S-54: Vulnerable Code Snippet - 41 + +#### Vulnerable Code: + +![Vulnerable Code](../media/code-41.jpg) + + +#### Solution: + +This code is vulnerable to CORS misconfiguration as can be observed on line-14. User-provided data, such as URL parameters, POST data payloads, or cookies, should always be considered untrusted and tainted. Applications constructing HTTP response headers based on tainted data could allow attackers to change security sensitive headers like Cross-Origin Resource Sharing headers. + +Twitter Thread: https://twitter.com/harshbothra_/status/1496326447954341891 + +##### Code Credits: @SonarSource \ No newline at end of file diff --git a/resources/vulnerable-code-42.md b/resources/vulnerable-code-42.md new file mode 100644 index 0000000..9d0f0fb --- /dev/null +++ b/resources/vulnerable-code-42.md @@ -0,0 +1,17 @@ +### SecurityExplained S-55: Vulnerable Code Snippet - 42 + +#### Vulnerable Code: + +![Vulnerable Code](../media/code-42.jpg) + + +#### Solution: + +This code is vulnerable to multiple security vulnerabilities: +1. The token generation algorithm is SHA-1 which is known to collision attacks and is not a best practice to use it. +2. There is a possibility of account takeover based on the actual implementation as an attacker may attempt to inject emails to get it routed to attacker email along with victim email. +3. This also looks vulnerable to Host Header Injection attack. + +Twitter Thread: https://twitter.com/harshbothra_/status/1496668703181651972 + +##### Code Credits: @SonarSource \ No newline at end of file diff --git a/resources/vulnerable-code-43.md b/resources/vulnerable-code-43.md new file mode 100644 index 0000000..f6a1895 --- /dev/null +++ b/resources/vulnerable-code-43.md @@ -0,0 +1,14 @@ +### SecurityExplained S-56: Vulnerable Code Snippet - 43 + +#### Vulnerable Code: + +![Vulnerable Code](../media/code-43.jpg) + + +#### Solution: + +This code is vulnerable to Command Injection as an attacker can inject malicious shell commands into the name of an uploaded file by using characters such as ";" or "`" to start a new command. + +Twitter Thread: https://twitter.com/harshbothra_/status/1496993342378242063 + +##### Code Credits: @SonarSource \ No newline at end of file diff --git a/resources/vulnerable-code-44.md b/resources/vulnerable-code-44.md new file mode 100644 index 0000000..feee118 --- /dev/null +++ b/resources/vulnerable-code-44.md @@ -0,0 +1,15 @@ +### SecurityExplained S-57: Vulnerable Code Snippet - 44 + +#### Vulnerable Code: + +![Vulnerable Code](../media/code-44.jpg) + + +#### Solution: + +As per @SonarSource, there is an XSS issue but maybe not as expected. Razor takes care of output encoding for ViewData in line 4. However, ViewData also overwrites the static content in ViewBag & there is an XSS in line 2. +Read More: https://sonarcloud.io/project/issues?id=SonarSourceResearch_2020_calendar_22&open=AXY4_4rsU9JBkqHd22a1&resolved=false&types=VULNERABILITY + +Twitter Thread: https://twitter.com/harshbothra_/status/1497431227451777027 + +##### Code Credits: @SonarSource \ No newline at end of file diff --git a/resources/vulnerable-code-45.md b/resources/vulnerable-code-45.md new file mode 100644 index 0000000..5f358ca --- /dev/null +++ b/resources/vulnerable-code-45.md @@ -0,0 +1,14 @@ +### SecurityExplained S-58: Vulnerable Code Snippet - 45 + +#### Vulnerable Code: + +![Vulnerable Code](../media/code-45.jpg) + + +#### Solution: + +This code is vulnerable to Path Traversal Attack. More information could be found here: https://sonarcloud.io/summary/overall?id=SonarSourceResearch_2020_calendar_15 + +Twitter Thread: https://twitter.com/harshbothra_/status/1497776001018859523 + +##### Code Credits: @SonarSource \ No newline at end of file diff --git a/resources/vulnerable-code-46.md b/resources/vulnerable-code-46.md new file mode 100644 index 0000000..e03b600 --- /dev/null +++ b/resources/vulnerable-code-46.md @@ -0,0 +1,15 @@ +### SecurityExplained S-62: Vulnerable Code Snippet - 46 + +#### Vulnerable Code: + +![Vulnerable Code](../media/code-46.jpg) + + +#### Solution: + +The code is vulnerable to File Upload Bypass attacks. Due to a lack of whitelist utilization, it is possible to bypass the extension check and upload a malicious files. + +Twitter Thread: https://twitter.com/harshbothra_/status/1499322445265661956 + +##### Code Credits: @0xRyuk + \ No newline at end of file diff --git a/resources/vulnerable-code-47.md b/resources/vulnerable-code-47.md new file mode 100644 index 0000000..a6db44f --- /dev/null +++ b/resources/vulnerable-code-47.md @@ -0,0 +1,19 @@ +### SecurityExplained S-68: Vulnerable Code Snippet - 47 + +#### Vulnerable Code: + +![Vulnerable Code](../media/code-47.jpg) + + +#### Solution: + +The code takes input into a fwrite() and gives it the function include() which use "stream_get_meta_data" to read headers and metadata for later use. The '$input' is inserted into fwrite() without any filter. +This makes it possible to infect a new "" tag and execute php code. + +Exploit Payload: + + +Twitter Thread: https://twitter.com/harshbothra_/status/1501384795623882758 + +##### Code Credits: @Brumens2 + \ No newline at end of file diff --git a/resources/vulnerable-code-48.md b/resources/vulnerable-code-48.md new file mode 100644 index 0000000..9355746 --- /dev/null +++ b/resources/vulnerable-code-48.md @@ -0,0 +1,18 @@ +### SecurityExplained S-69: Vulnerable Code Snippet - 48 + +#### Vulnerable Code: + +![Vulnerable Code](../media/code-48.jpg) + + +#### Solution: + +The code checks if the username is "admin" should be the only user that is allowed to add new comments. The code does use the function "strtolower()". + +This means if a user registers a new account with the username as "ADMIN" that do not have the privileges. The user is still able to add a new comment +and the filter is bypassed. + +Twitter Thread: https://twitter.com/harshbothra_/status/1501738369990070275 + +##### Code Credits: @Brumens2 + \ No newline at end of file diff --git a/resources/vulnerable-code-49.md b/resources/vulnerable-code-49.md new file mode 100644 index 0000000..d9a8948 --- /dev/null +++ b/resources/vulnerable-code-49.md @@ -0,0 +1,19 @@ +### SecurityExplained S-70: Vulnerable Code Snippet - 49 + +#### Vulnerable Code: + +![Vulnerable Code](../media/code-49.png) + + +#### Solution: + +This code is vulnerable to LDAP Injection. User-provided data such as URL parameters should always be considered as untrusted and tainted. Constructing LDAP names or search filters directly from tainted data enables attackers to inject specially crafted values that changes the initial meaning of the name or filter itself. Successful LDAP injections attacks can read, modify or delete sensitive information from the directory service. + +Within LDAP names, the special characters ' ', '#', '"', '+', ',', ';', '<', '>', '\' and null must be escaped according to RFC 4514, for example by replacing them with the backslash character '\' followed by the two hex digits corresponding to the ASCII code of the character to be escaped. Similarly, LDAP search filters must escape a different set of special characters (including but not limited to '*', '(', ')', '\' and null) according to RFC 4515. + +Reference: https://rules.sonarsource.com/php/type/Vulnerability/RSPEC-2078 + +Twitter Thread: https://twitter.com/harshbothra_/status/1502115860084785152 + +##### Code Credits: @SonarSource + \ No newline at end of file diff --git a/resources/vulnerable-code-50.md b/resources/vulnerable-code-50.md new file mode 100644 index 0000000..979b882 --- /dev/null +++ b/resources/vulnerable-code-50.md @@ -0,0 +1,17 @@ +### SecurityExplained S-71: Vulnerable Code Snippet - 50 + +#### Vulnerable Code: + +![Vulnerable Code](../media/code-50.png) + + +#### Solution: + +This is vulnerable to Cross-Site Scripting as there is no input sanitization on the $name. + +Reference: https://rules.sonarsource.com/php/type/Vulnerability/RSPEC-5131 + +Twitter Thread: https://twitter.com/harshbothra_/status/1502463146203631616 + +##### Code Credits: @SonarSource + \ No newline at end of file diff --git a/resources/vulnerable-code-51.md b/resources/vulnerable-code-51.md new file mode 100644 index 0000000..63392f5 --- /dev/null +++ b/resources/vulnerable-code-51.md @@ -0,0 +1,20 @@ +### SecurityExplained S-72: Vulnerable Code Snippet - 51 + +#### Vulnerable Code: + +![Vulnerable Code](../media/code-51.png) + + +#### Solution: + +This code is vulnerable to SQL Injection attacks. +User-provided data, such as URL parameters, should always be considered untrusted and tainted. Constructing SQL queries directly from tainted data enables attackers to inject specially crafted values that change the initial meaning of the query itself. Successful database query injection attacks can read, modify, or delete sensitive information from the database and sometimes even shut it down or execute arbitrary operating system commands. The solution is to use prepared statements and to bind variables to SQL query parameters with dedicated methods like bindParam, which ensures that user-provided data will be properly escaped. + +Another solution is to validate every parameter used to build the query. This can be achieved by transforming string values to primitive types or by validating them against a white list of accepted values. + +Reference: https://rules.sonarsource.com/php/type/Vulnerability/RSPEC-3649 + +Twitter Thread: https://twitter.com/harshbothra_/status/1502806574368129024 + +##### Code Credits: @SonarSource + \ No newline at end of file diff --git a/resources/vulnerable-code-52.md b/resources/vulnerable-code-52.md new file mode 100644 index 0000000..4567da2 --- /dev/null +++ b/resources/vulnerable-code-52.md @@ -0,0 +1,18 @@ +### SecurityExplained S-73: Vulnerable Code Snippet - 52 + +#### Vulnerable Code: + +![Vulnerable Code](../media/code-52.png) + + +#### Solution: + +This code is vulnerable to XPATH Injection. User-provided data, such as URL parameters, should always be considered untrusted and tainted. Constructing XPath expressions directly from tainted data enables attackers to inject specially crafted values that changes the initial meaning of the expression itself. Successful XPath injection attacks can read sensitive information from XML documents. + + +Reference: https://rules.sonarsource.com/php/type/Vulnerability/RSPEC-2091 + +Twitter Thread: https://twitter.com/harshbothra_/status/1503112764985815043 + +##### Code Credits: @SonarSource + \ No newline at end of file diff --git a/resources/vulnerable-code-53.md b/resources/vulnerable-code-53.md new file mode 100644 index 0000000..4ae91dd --- /dev/null +++ b/resources/vulnerable-code-53.md @@ -0,0 +1,19 @@ +### SecurityExplained S-74: Vulnerable Code Snippet - 53 + +#### Vulnerable Code: + +![Vulnerable Code](../media/code-53.png) + + +#### Solution: + +This code is vulnerable to Session Fixation Attacks. Session fixation attacks occur when an attacker can force a legitimate user to use a session ID that he knows. + +To avoid fixation attacks, it’s a good practice to generate a new session each time a user authenticates and delete/invalidate the existing session (the one possibly known by the attacker). + +Reference: https://t.co/gdwErw0aml + +Twitter Thread: https://twitter.com/harshbothra_/status/1503559120841949186 + +##### Code Credits: @SonarSource + \ No newline at end of file diff --git a/resources/vulnerable-code-54.md b/resources/vulnerable-code-54.md new file mode 100644 index 0000000..d443f67 --- /dev/null +++ b/resources/vulnerable-code-54.md @@ -0,0 +1,23 @@ +### SecurityExplained S-75: Vulnerable Code Snippet - 54 + +#### Vulnerable Code: + +![Vulnerable Code](../media/code-54.png) + + +#### Solution: + +This code is vulnerable to ZipSlip Attack. + +File names of the entries in a zip archive should be considered untrusted, tainted and should be validated before being used for file system operations. Indeed, file names can contain specially crafted values, such as '../', that change the initial path and, when accessed, resolve to a path on the filesystem where the user should normally not have access. + +A successful attack might give an attacker the ability to read, modify, or delete sensitive information from the file system and sometimes even execute arbitrary operating system commands. This special case of path injection vulnerabilities is called "zip slip". + +The mitigation strategy should be based on the whitelisting of allowed paths or characters. + +Reference: https://rules.sonarsource.com/javascript/type/Vulnerability/RSPEC-6096 + +Twitter Thread: https://twitter.com/harshbothra_/status/1503912699104702464 + +##### Code Credits: @SonarSource + \ No newline at end of file diff --git a/resources/vulnerable-code-55.md b/resources/vulnerable-code-55.md new file mode 100644 index 0000000..48cd1f9 --- /dev/null +++ b/resources/vulnerable-code-55.md @@ -0,0 +1,25 @@ +### SecurityExplained S-76: Vulnerable Code Snippet - 55 + +#### Vulnerable Code: + +![Vulnerable Code](../media/code-55.png) + + +#### Solution: + +This code is vulnerable to NoSQL Injection Attack. + +User-provided data such as URL parameters and POST body-content should always be considered untrusted and tainted. + +Applications that perform NoSQL operations based on tainted data can be exploited similarly to regular SQL injection bugs. Depending on the code, the same risks exist as with SQL injections: The attacker aims to access sensitive information or compromise data integrity. Attacks may involve the injection of query operators, JavaScript code, or string operations. + +This problem can be mitigated by using an Object Document Mapper (ODM) library or by validating user-supplied data based on its size or allowed characters. + +Since Javascript allows different types of HTTP parameters, the problem could be mitigated by ensuring that the type of the input is a String or by sanitizing the user-provided data. + +Reference: https://rules.sonarsource.com/javascript/type/Vulnerability/RSPEC-5147 + +Twitter Thread: https://twitter.com/harshbothra_/status/1504305286869241857 + +##### Code Credits: @SonarSource + \ No newline at end of file diff --git a/resources/vulnerable-code-56.md b/resources/vulnerable-code-56.md new file mode 100644 index 0000000..7278b7d --- /dev/null +++ b/resources/vulnerable-code-56.md @@ -0,0 +1,21 @@ +### SecurityExplained S-77: Vulnerable Code Snippet - 56 + +#### Vulnerable Code: + +![Vulnerable Code](../media/code-56.png) + + +#### Solution: + +This code is vulnerable to SQL Injection Attack. + +User-provided data, such as URL parameters, should always be considered untrusted and tainted. Constructing SQL queries directly from tainted data enables attackers to inject specially crafted values that change the initial meaning of the query itself. Successful database query injection attacks can read, modify, or delete sensitive information from the database and sometimes even shut it down or execute arbitrary operating system commands. + +Typically, the solution is to use prepared statements and to bind variables to SQL query parameters with dedicated methods like setParameter, which ensures that user-provided data will be properly escaped. Another solution is to validate every parameter used to build the query. This can be achieved by transforming string values to primitive types or by validating them against a white list of accepted values. + +Reference: https://rules.sonarsource.com/javascript/type/Vulnerability/RSPEC-3649 + +Twitter Thread: https://twitter.com/harshbothra_/status/1504637477297934337 + +##### Code Credits: @SonarSource + \ No newline at end of file diff --git a/resources/vulnerable-code-57.md b/resources/vulnerable-code-57.md new file mode 100644 index 0000000..b08a179 --- /dev/null +++ b/resources/vulnerable-code-57.md @@ -0,0 +1,23 @@ +### SecurityExplained S-78: Vulnerable Code Snippet - 57 + +#### Vulnerable Code: + +![Vulnerable Code](../media/code-57.png) + + +#### Solution: + +This code is vulnerable to Unrestricted File Upload Attack. + +These minimum restrictions should be applied when handling file uploads: + +the file upload folder to restrict untrusted files to a specific folder. +the file extension of the uploaded file to prevent remote code execution. +Also the size of the uploaded file should be limited to prevent denial of service attacks. + +Reference: https://rules.sonarsource.com/javascript/type/Vulnerability/RSPEC-2598 + +Twitter Thread: https://twitter.com/harshbothra_/status/1504999863632637959 + +##### Code Credits: @SonarSource + \ No newline at end of file diff --git a/resources/vulnerable-code-58.md b/resources/vulnerable-code-58.md new file mode 100644 index 0000000..36998af --- /dev/null +++ b/resources/vulnerable-code-58.md @@ -0,0 +1,23 @@ +### SecurityExplained S-79: Vulnerable Code Snippet - 58 + +#### Vulnerable Code: + +![Vulnerable Code](../media/code-58.png) + + +#### Solution: + +This code is vulnerable to Open Redirection Attack. + +These minimum restrictions should be applied when handling file uploads: + +the file upload folder to restrict untrusted files to a specific folder. +the file extension of the uploaded file to prevent remote code execution. +Also the size of the uploaded file should be limited to prevent denial of service attacks. + +Reference: https://rules.sonarsource.com/javascript/type/Vulnerability/RSPEC-5146 + +Twitter Thread: https://twitter.com/harshbothra_/status/1505392450499584003 + +##### Code Credits: @SonarSource + \ No newline at end of file diff --git a/resources/vulnerable-code-59.md b/resources/vulnerable-code-59.md new file mode 100644 index 0000000..40a0f7e --- /dev/null +++ b/resources/vulnerable-code-59.md @@ -0,0 +1,21 @@ +### SecurityExplained S-80: Vulnerable Code Snippet - 59 + +#### Vulnerable Code: + +![Vulnerable Code](../media/code-59.png) + + +#### Solution: + +This code is vulnerable to Session Fixation Attack. + +User-provided data, such as URL parameters, should always be considered untrusted and tainted. Constructing cookies directly from tainted data enables attackers to set the session identifier to a known value, allowing the attacker to share the session with the victim. Successful attacks might result in unauthorized access to sensitive information, for example if the session identifier is not regenerated when the victim authenticates. + +Typically, the solution to prevent this type of attack is to restrict the cookies that can be influenced with an allow-list. + +Reference: https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-6287 + +Twitter Thread: https://twitter.com/harshbothra_/status/1505733449285468165 + +##### Code Credits: @SonarSource + \ No newline at end of file diff --git a/resources/vulnerable-code-60.md b/resources/vulnerable-code-60.md new file mode 100644 index 0000000..80c6387 --- /dev/null +++ b/resources/vulnerable-code-60.md @@ -0,0 +1,21 @@ +### SecurityExplained S-81: Vulnerable Code Snippet - 60 + +#### Vulnerable Code: + +![Vulnerable Code](../media/code-60.png) + + +#### Solution: + +This code is vulnerable to Remote Code Execution. + +Applications that execute code dynamically should neutralize any externally-provided values used to construct the code. Failure to do so could allow an attacker to execute arbitrary code. This could enable a wide range of serious attacks like accessing/modifying sensitive information or gain full system access. + +The mitigation strategy should be based on whitelisting of allowed values or casting to safe types. + +Reference: https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-5334 + +Twitter Thread: https://mobile.twitter.com/harshbothra_/status/1506095330395258885 + +##### Code Credits: @SonarSource + \ No newline at end of file diff --git a/resources/vulnerable-code-61.md b/resources/vulnerable-code-61.md new file mode 100644 index 0000000..9dd052a --- /dev/null +++ b/resources/vulnerable-code-61.md @@ -0,0 +1,21 @@ +### SecurityExplained S-82: Vulnerable Code Snippet - 61 + +#### Vulnerable Code: + +![Vulnerable Code](../media/code-61.png) + + +#### Solution: + +This code is vulnerable to Remote Code Execution. + +Applications that execute code dynamically should neutralize any externally-provided values used to construct the code. Failure to do so could allow an attacker to execute arbitrary code. This could enable a wide range of serious attacks like accessing/modifying sensitive information or gain full system access. + +The mitigation strategy should be based on whitelisting of allowed values or casting to safe types. + +Reference: https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-5334 + +Twitter Thread: https://twitter.com/harshbothra_/status/1506472817621045249 + +##### Code Credits: @SonarSource + \ No newline at end of file diff --git a/resources/vulnerable-code-62.md b/resources/vulnerable-code-62.md new file mode 100644 index 0000000..768006c --- /dev/null +++ b/resources/vulnerable-code-62.md @@ -0,0 +1,21 @@ +### SecurityExplained S-83: Vulnerable Code Snippet - 62 + +#### Vulnerable Code: + +![Vulnerable Code](../media/code-62.png) + + +#### Solution: + +This code is vulnerable to LDAP Injection. + +User-provided data such as URL parameters should always be considered as untrusted and tainted. Constructing LDAP names or search filters directly from tainted data enables attackers to inject specially crafted values that changes the initial meaning of the name or filter itself. Successful LDAP injections attacks can read, modify or delete sensitive information from the directory service. + +Within LDAP names, the special characters ' ', '#', '"', '+', ',', ';', '<', '>', '\' and null must be escaped according to RFC 4514, for example by replacing them with the backslash character '\' followed by the two hex digits corresponding to the ASCII code of the character to be escaped. Similarly, LDAP search filters must escape a different set of special characters (including but not limited to '*', '(', ')', '\' and null) according to RFC 4515. + +Reference: https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2078 + +Twitter Thread: https://twitter.com/harshbothra_/status/1506850305970901000 + +##### Code Credits: @SonarSource + \ No newline at end of file diff --git a/resources/vulnerable-code-63.md b/resources/vulnerable-code-63.md new file mode 100644 index 0000000..9a7d31e --- /dev/null +++ b/resources/vulnerable-code-63.md @@ -0,0 +1,23 @@ +### SecurityExplained S-84: Vulnerable Code Snippet - 63 + +#### Vulnerable Code: + +![Vulnerable Code](../media/code-63.png) + + +#### Solution: + +This code is vulnerable to Path Injection Attack. + +User-provided data, such as URL parameters, POST data payloads, or cookies, should always be considered untrusted and tainted. Constructing file system paths directly from tainted data could enable an attacker to inject specially crafted values, such as '../', that change the initial path and, when accessed, resolve to a path on the filesystem where the user should normally not have access. + +A successful attack might give an attacker the ability to read, modify, or delete sensitive information from the file system and sometimes even execute arbitrary operating system commands. This is often referred to as a "path traversal" or "directory traversal" attack. + +The mitigation strategy should be based on the whitelisting of allowed paths or characters. + +Reference: https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-2078 + +Twitter Thread: https://twitter.com/harshbothra_/status/1507167395315548171 + +##### Code Credits: @SonarSource + \ No newline at end of file diff --git a/resources/vulnerable-code-64.md b/resources/vulnerable-code-64.md new file mode 100644 index 0000000..d39e9c7 --- /dev/null +++ b/resources/vulnerable-code-64.md @@ -0,0 +1,31 @@ +### SecurityExplained S-85: Vulnerable Code Snippet - 64 + +#### Vulnerable Code: + +![Vulnerable Code](../media/code-64.png) + + +#### Solution: + +This code is vulnerable to Insecure Deserialization Attack. + +User-provided data such as URL parameters, POST data payloads or cookies should always be considered untrusted and tainted. Deserialization based on data supplied by the user could result in two types of attacks: + +Remote code execution attacks, where the structure of the serialized data is changed to modify the behavior of the object being unserialized. +Parameter tampering attacks, where data is modified to escalate privileges or change for example quantity or price of products. +The best way to protect against deserialization attacks is probably to challenge the use of the deserialization mechanism in the application. They are cases were the use of deserialization mechanism was not justified and created breaches (CVE-2017-9785). + +If the use of deserialization mechanisms is valid in your context, the problem could be mitigated in any of the following ways: +- Instead of using a native data interchange format, use a safe, standard format such as untyped JSON or structured data approaches such as Google Protocol Buffers. + +- To ensure integrity is not compromised, add a digital signature (HMAC) to the serialized data that is validated before deserialization (this is only valid if the client doesn’t need to modify the serialized data) + +- As a last resort, restrict deserialization to be possible only to specific, whitelisted classes. + + +Reference: https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-5135 + +Twitter Thread: https://twitter.com/harshbothra_/status/1507544881308188674 + +##### Code Credits: @SonarSource + \ No newline at end of file diff --git a/resources/vulnerable-code-65.md b/resources/vulnerable-code-65.md new file mode 100644 index 0000000..311a628 --- /dev/null +++ b/resources/vulnerable-code-65.md @@ -0,0 +1,24 @@ +### SecurityExplained S-86: Vulnerable Code Snippet - 65 + +#### Vulnerable Code: + +![Vulnerable Code](../media/code-65.png) + + +#### Solution: + +This code is vulnerable to NoSQL Injection Attack. + +User-provided data such as URL parameters and POST body-content should always be considered untrusted and tainted. + +Applications that perform NoSQL operations based on tainted data can be exploited similarly to regular SQL injection bugs. Depending on the code, the same risks exist as with SQL injections: The attacker aims to access sensitive information or compromise data integrity. Attacks may involve the injection of query operators, JavaScript code, or string operations. + +This problem can be mitigated by using an Object Document Mapper (ODM) library or by validating user-supplied data based on its size or allowed characters. + + +Reference: https://rules.sonarsource.com/java/type/Vulnerability/RSPEC-5147 + +Twitter Thread: https://twitter.com/harshbothra_/status/1507857619532144646 + +##### Code Credits: @SonarSource + \ No newline at end of file