All attack articles should follow the Attack template.

Work to be done here includes

We’re in the process of creating, organizing, and completing the attack articles. If you’d like to help, find some stub articles in this category and fill in the details.

Creating articles for the following topics:

• Unauthorized Access Attempts
• File location guessing (see Guessed or visible temporary file)
• URL Redirection
• … make sure the attack is listed for each vulnerability

Note: many of the items marked vulnerabilities from CLASP and other places are really attacks. Some of the more obvious are:

• Log injection
• Resource exhaustion
• Reflection injection
• Reflection attack in an auth protocol

Please do not post any actual vulnerabilities in products, services, or web applications. Those disclosure reports should be posted to bugtraq or full-disclosure mailing lists.

Examples of vulnerabilities

• Lack of input validation on user input
• Lack of sufficient logging mechanism
• Fail-open error handling
• Not closing the database connection properly

For a great overview, check out the OWASP Top Ten Project. You can read about the top vulnerabilities and download a paper that covers them in detail. Many organizations and agencies use the Top Ten as a way of creating awareness about application security.

Application security principles are collections of desirable application properties, behaviors, designs and implementation practices that attempt to reduce the likelihood of threat realization and impact should that threat be realized. Security principles are language independent, architecturally neutral primitives that can be leveraged within most software development methodologies to design and construct applications.

Principles are important because they help us make security decisions in new situations with the same basic ideas. By considering each of these principles, we can derive security requirements, make architecture and implementation decisions, and identify possible weaknesses in systems.

The important thing to remember is that in order to be useful, principles must be evaluated, interpreted, and applied to address a specific problem. Although principles can serve as general guidelines, simply telling a software developer that their software must “fail securely” or that they should do “defense in depth” won’t mean that much.

Some proven application security principles

• Apply defense in depth (complete mediation)
• Use a positive security model (fail safe defaults)(minimize attack surface)
• Fail securely
• Run with least privilege
• Avoid security by obscurity (open design)
• Keep security simple (verifiable)(economy of mechanism)
• Detect intrusions (compromise recording)
• Don’t trust infrastructure
• Don’t trust services
• Establish secure defaults (psychological acceptability)

Tanya donk ke OmGo!!!

goan      : OmGo aku harus tulis apa???

OmGo    : Yaa… tulis aja apa yang ada dipikiranmu sekarang