4 ms·
Top-10 Web Application Security Vulnerabilities (2007)
- rdj 16y agoObligatory link to the 2010 list of the top 10 risks: http://www.owasp.org/index.php/Top_10_2010-Main http://www.owasp.org/index.php/Top_10_2010-Main Interesting how many items are still there from 2004 to 2007 to 2010.
- JabavuAdams 16y agoArgh, didn't see that. Thanks.
- Locke1689 16y agoIIRC, I think I analyzed and organized those pages in 2007. Looks like the big ones (XSS, injection) are still pretty much the same. In fact, looks like most of my work is pretty much the same, but some shiny new graphics have been added. :) You'd be surprised at the number of pages I come across that still have these basic insecurities. Thankfully, automatic checking is making really basic CSRF attacks less prevalent. I'm sure tptacek or someone more familiar with the current hotlist would have more to say, though.
- abyssknight 16y agoI'm on a team that is writing documentation for developers to mitigate the OWASP Top 10 and CWE 25. You'd be surprised how many intelligent, bright developers think that because their code is behind the firewall it is safe and acceptable to leave those kinds of holes wide open.
- marcinw 16y agoAdd SSL to the list, along with hidden form parameters and request headers. It's as if nobody's ever heard of using cURL or an HTTP proxy, even if for debugging purposes.
- abyssknight 16y agoWe're actually covering code analysis, testing, and fuzzing tools as well. Great depth of information coming out of this thing. :)
- chair6 16y agoThe Top-10 is just a start. As a penetration tester and sometimes-trainer, I find it's when developers start to see practical demonstrations of what these vulnerabilities can actually allow a malicious party to achieve that the eyes really get opened. Particularly when those demonstrations are within their own applications. Check out the rest of the OWASP site, and play with WebGoat (http://www.owasp.org/index.php/Category:OWASP_WebGoat_Project http://www.owasp.org/index.php/Category:OWASP_WebGoat_Projec...). Take a look at the 'Web Security' section here: http://code.google.com/edu/courses.html http://code.google.com/edu/courses.html Start following some of the many webappsec blogs floating around the interwebs, subscribe to mailing lists, read tweets: http://www.gnucitizen.org/ http://www.gnucitizen.org/ http://ha.ckers.org/ http://ha.ckers.org/ http://jeremiahgrossman.blogspot.com/ http://jeremiahgrossman.blogspot.com/ http://www.webappsec.org/lists/websecurity/ http://www.webappsec.org/lists/websecurity/ http://twitter.com/#search?q=%23WebAppSec http://twitter.com/#search?q=%23WebAppSec There is a huge amount of information out there.
- JabavuAdams 16y agoThanks, that's great information. Do you mind if I add it to the (public) notes on my web-page? How should I cite you?
- chair6 16y agoGo for it, no need to cite.
- JabavuAdams 16y agoPosted. Cited anyway. http://www.shinyfish.com/wiki/WebApplicationSecurity.html http://www.shinyfish.com/wiki/WebApplicationSecurity.html