Most Vulnerable Places on a Website

[subornaakter20]

Let's list the main website vulnerabilities that are worth paying attention to.

Injections/Injection

Injections are weaknesses that occur when a user passes unverified data to the interpreter for execution. That is, any Internet user can arbitrarily enter code into the interpreter. The most common types of injections are SQL, OS, XXE, and LDAP.

You've probably never heard of the last three. But you're definitely familiar with sites with SQL vulnerabilities. Using them, a hacker can penetrate a database, read secret information medical mail list from it, and even enter his own values. Injections occur when there is no check whether the information passed to the interpreter contains control sequences and commands, such as quotes in SQL.

Problems with authentication and session checking
Many applications require users to be identified before they can use them. Often, authentication and session management are not properly performed, allowing hackers to access user accounts without passwords. Fraudsters can obtain keys or session tokens that identify users and use them temporarily or permanently.

XSS
Injections and problems with authentication and session verification are the most dangerous for the site and its server. XSS does not pose a serious threat to the server. However, XSS is dangerous for the site visitor. XSS works in his browser and allows his information to be stolen.

Creation of a technical department

Source: shutterstock.com

XSS, or Cross-Site Scripting, works in JavaScript on the same principle as injections. The fraudster transmits a special line with JS code in one of the fields. The browser thinks that this code was sent by the site and executes it. The code can be anything. To protect against such attacks, all special characters must be escaped using the html special chars function or similar.

Access control issues
Often, due to the carelessness of administrators, ordinary users gain access to closed information. This problem is typical even for popular engines.

A clear example is files in the root of a website. Let's say the wp-config.php file with database access passwords is closed thanks to its php extension. But editing it in Vim and saving it incorrectly leads to the creation of a backup copy with the .swp extension, which can then be safely opened in a browser.